Xybern: The Authorisation Layer for Autonomous AI Agents

Founded by Dr. Charalambos Theodorou, Xybern is building the security and authorisation infrastructure required to control autonomous AI agents before they act.

Your AI agents act. Xybern decides if they can.

Xybern sits between agent intent and execution, evaluating identity, authority, delegation, active policies and context before allowing an action, denying it or pausing it for human approval, then sealing the decision as cryptographic evidence in the Provenance Vault.

Explore Xybern →

Why Autonomous AI Needs an Authorisation Layer

Traditional identity and access management was built for humans, applications and predictable machine identities. Autonomous agents reason about objectives, choose tools and act dynamically, which introduces new security challenges.

The Xybern Authorisation Layer

A security boundary between autonomous AI and the systems it can affect. Every protected action passes through a mandatory authorisation process, identity, authority, delegation, policy, MCP and tool security, human approval and cryptographic provenance, before execution.

Agent Identity

Autonomous agents need identities that can be independently controlled and governed, so every action is attributable to a specific agent or workload with explicit authority.

Charters & Mandates

Charters and mandates define the authority under which an agent operates, the scope within which it is permitted to act, rather than broad access and hope.

Agent-to-Agent Authorisation

In multi-agent systems, delegating a task should not transfer every permission the originating agent holds. Xybern narrows authority as it moves through a delegation chain.

MCP & Tool Security

MCP gives agents capability; Xybern decides authority, enforcing which servers, tools, resources and even argument values an agent may use, evaluated before each tool call runs.

Runtime Controls & Containment

Authorisation does not end at deployment. Xybern can narrow or revoke authority and contain active agents in real time, with kill-switch controls for critical situations.

Human Approval

Some actions cross an irreversible or high-risk boundary. Xybern can pause those before execution and route them to an authorised human, keeping routine work autonomous.

External Agent Federation

Enterprises increasingly interact with agents operated by partners, vendors and other organisations. Xybern lets an external agent operate inside a locally controlled authority boundary.

Temporal Authority & Breakglass Controls

Agents do not always need permanent authority. Permissions can be scoped to a task, session or time window and expire automatically, with audited breakglass access for emergencies.

Cryptographic Provenance

Audit logs answer what happened. The Xybern Provenance Vault answers why an action was authorised, as tamper-evident, selectively verifiable evidence.

Deployment Within the Enterprise Security Boundary

Xybern supports different deployment models based on regulatory, security, sovereignty, isolation and data-residency requirements, from managed cloud to fully sovereign infrastructure.

Deployment Is Not Integration

Where Xybern runs and how it integrates are separate decisions, pick the infrastructure model your security requires, then integrate into the AI architecture you already operate.

Framework & Model Agnostic

Xybern is security infrastructure, not another agent framework, one authorisation boundary across different models, agent frameworks and orchestration architectures.

Built for Regulated & Mission-Critical Environments

Xybern is designed for environments where an unauthorised autonomous action becomes more than a software error, it becomes a financial, regulatory, security or operational event.

Why I Founded Xybern

As AI agents evolved from assistants that suggested into autonomous systems that act, I kept arriving at the same gap: we were becoming very good at making agents capable, but capability and authority are not the same thing.

Building the Security Boundary for Autonomous AI

The shift from generative to autonomous AI changes the security problem. When AI can take actions, organisations must control authority, not just what goes into and comes out of a model.

About the Founder

Dr. Charalambos Theodorou

Founder & CEO of Xybern | PhD in Artificial Intelligence | Agentic Security

Dr. Charalambos Theodorou is an AI researcher, engineer and entrepreneur and the Founder and CEO of Xybern. His work focuses on artificial intelligence, autonomous agents and the emerging security infrastructure required to govern machine identity, authority, delegation and execution. He holds a PhD in Artificial Intelligence and has worked across machine learning, computer vision, large language models, autonomous systems and AI security.

About Dr. Charalambos Theodorou → Research & Publications →

The Problem

Why Autonomous AI Needs an Authorisation Layer

An agent can reason about an objective, select tools, call APIs, interact with MCP servers, access databases, trigger workflows and delegate tasks, dynamically deciding which actions to perform. That creates several new security challenges.

Unbounded Authority

Agents can inherit credentials far broader than the task at hand, technically capable of an action without legitimate authority to perform it.

Agent-to-Agent Privilege Propagation

When one agent delegates to another, authority can propagate through the chain unless explicit delegation boundaries are enforced.

MCP & Tool Exposure

Access to an MCP server should not automatically mean unrestricted access to every tool, resource or action it exposes.

No Proof of Authority

Logs show what happened; they do not prove which authority permitted an action, which policies were evaluated, or why it was allowed.

Autonomous capability should never imply autonomous authority.

Explore Xybern

The Pipeline

The Mandatory Authorisation Pipeline

Every protected autonomous action passes through six stages before execution.

Intercept

Every protected action enters the Authorisation Layer before reaching the target system, it cannot bypass the decision and execute directly.

Authenticate Agent Identity

Xybern resolves the identity of the agent, service or external workload attempting the action.

Resolve Authority

It determines the agent's active mandate, inherited constraints, delegation chain and session context, the authority it actually holds at that moment.

Evaluate Charter

The action is evaluated against the organisation's active Charter and contextual conditions, not just whether it has access, but whether the action falls within granted authority.

Enforce

Xybern issues an enforceable decision before execution. Only authorised actions proceed.

AuthoriseDenyPause for Human Approval

Prove

The decision and its authorisation lineage can be cryptographically sealed in the Provenance Vault, verifiable evidence of who acted, which authority applied and what was decided.

Explore Xybern

Authority

Charters & Mandates

Instead of giving an agent broad access and hoping its behaviour stays within intended boundaries, organisations define the scope within which it is permitted to act. Authority can include constraints around:

permitted actions;
resources;
tools;
transaction parameters;
destinations;
delegation;
temporal windows;
human approval requirements;
contextual conditions;
and emergency controls.

These rules are evaluated as part of the authorisation process before execution, separating two concepts:

What an agent is capable of doing and what an agent has authority to do.

Explore Xybern

Delegation

Agent-to-Agent Authorisation

Xybern is designed so that authority narrows as it moves through a delegation chain.

Scoped Delegation

Only the permissions required for the delegated task need to be transferred.

Time-Bound Authority

Delegated permissions can expire with the task, session or authorised time window.

No Privilege Expansion

A downstream agent never gains greater authority simply because work was delegated to it; it stays bounded by the originating chain.

Full Delegation Lineage

Downstream actions remain traceable so organisations can determine where authority originated and how it propagated.

An enforceable chain of authority across autonomous multi-agent systems.

Explore Xybern

MCP & Tools

MCP & Tool Security

MCP gives agents capability. Xybern decides authority.

Xybern enforces which agents may access which MCP servers, and which tools within those servers they may invoke.

MCP Server Access

One agent may reach a particular MCP server while another is prevented from reaching it entirely.

Tool-Level Authority

An agent can use one tool while being denied another on the same server. For example, payments.read may be permitted while payments.transfer is denied.

Argument-Level Authorisation

The arguments supplied to a tool can also be evaluated, a transfer authorised only below an amount, to approved counterparties, from permitted accounts or within a time window.

Delegation Enforcement

Access through one agent does not propagate automatically to downstream agents; the same delegation boundaries continue to apply.

Every protected tool invocation is evaluated before it runs.

Explore Xybern

Provenance

Cryptographic Provenance

The Provenance Vault preserves cryptographic evidence of the complete authorisation lineage behind autonomous actions. For an action, the evidence can establish:

which agent acted;
which identity was authenticated;
what authority the agent held;
how that authority was delegated;
which Charter and policies were evaluated;
whether human approval was required;
what decision was produced;
and what ultimately executed.

Records can be protected through hash chains, signatures and Merkle proofs for tamper-evident, selectively verifiable evidence.

"Here is cryptographic evidence of the authority under which this happened."

Explore Xybern

Deployment

Deployment Within the Enterprise Security Boundary

Xybern Cloud

Managed infrastructure for the fastest path to deploying the Authorisation Layer, an isolated environment for agents, Charters, MCP connections, approvals and provenance, without operating the underlying infrastructure.

Dedicated Environment

Stronger infrastructure separation for regulated and mission-critical organisations, dedicated compute, storage and networking, while retaining a managed platform.

Sovereign Deployment

For maximum control, Xybern can run inside customer-controlled or approved infrastructure, retaining control over location, network boundaries, data residency, encryption keys, storage, administrative access, logging and retention.

Explore Xybern

Industries

Built for Regulated & Mission-Critical Environments

Government & Defence

Control autonomous access to sensitive systems, enforce chains of authority and preserve verifiable evidence of machine decisions.

Financial Services

Authorise payments, customer-data access, trading operations, privileged workflows and agent-to-agent delegation before execution.

Healthcare

Constrain how autonomous systems interact with patient data, clinical systems and high-impact workflows while retaining human approval at critical boundaries.

Critical Infrastructure

Control autonomous actions across energy, telecommunications, industrial and other environments where unintended execution has physical or operational consequences.

Explore Xybern

Founder Story

Why I Founded Xybern

An agent being technically capable of performing an action does not mean it should be permitted to perform it.

Authentication alone does not solve this. Knowing which agent is making a request does not determine whether it should be permitted to perform a specific action, on a specific resource, with particular parameters, through a particular delegation chain and under the current conditions.

Monitoring does not solve it either. By the time a monitoring system tells you an agent performed an unauthorised action, the action may already have reached production.

I founded Xybern around the belief that autonomous AI requires an explicit security boundary between intent and execution, a layer capable of asking, before an action happens:

Who is this agent?
What authority does it currently hold?
Where did that authority come from?
Can it delegate that authority?
Does the action comply with the organisation's Charter?
Does it require human approval?
Should it be authorised or denied?
Can the resulting decision be proven later?

As autonomous AI moves deeper into enterprise and mission-critical environments, identity, authorisation, delegation and cryptographic provenance will become foundational security infrastructure for the agentic economy.

Explore Xybern