Two weeks ago I wrote about the 41% of public MCP servers that ship with no authentication, and I framed the useful question as: where should the lock live? At the time the industry had produced two answers — Ory put the lock in the agent harness, and the MCP spec standardized it at the wire. Both are software locks, guarding software, running on the same machines the agents run on.

Last week a third answer arrived, and it is the most philosophically interesting of the lot. On July 15, Ledger — the hardware wallet company — launched the Ledger Agent Stack, an open-source toolkit that lets AI agents work with crypto wallets, read balances, analyze portfolios, and prepare transactions — while the actual signing of anything that moves value requires a physical confirmation on a Ledger device. A screen the agent cannot draw on. A button the agent cannot press.

The lock, in other words, moved off the computer entirely.

What the thing actually is

The Agent Stack is a set of command-line tools and skills — Device Management Kit Skills, a Wallet CLI, an Enterprise CLI, an Enterprise Multisig CLI — designed to plug into Claude Code, Codex, Cursor, or, as Ledger puts it, any shell-capable agent. The division of labor is stated with unusual clarity: agents propose, humans approve, hardware enforces.

Concretely: read-only operations run straight through the CLI. Your agent can check balances, pull transaction history, watch a portfolio, and draft a transfer without asking anyone. But the moment an action would move funds, the prepared transaction routes to the Ledger device, the details render on the device's own screen, and nothing happens until a human physically confirms on the hardware. The private keys never leave the device, which means there is no credential for a compromised agent to steal, no signing function for a prompt injection to invoke. Ledger says more than 1,000 agents went through the private preview before the public release, which shipped as the first deliverable of the company's 2026 AI security roadmap.

My favorite detail is a job title. The launch quotes Ian Rogers, Ledger's Chief Human Agency Officer — a role name that would have sounded like satire in 2024 and now reads like an org chart catching up with reality. His one-line thesis: "Software should not be the final authority when value moves."

Why this is a different kind of lock

Sit with that sentence, because it is a sharper architectural claim than it looks. Every agent-security product I have covered this year — the gateways, the control planes, the runtime guardrails, the OAuth rewrite — shares one property: the enforcement mechanism is software, running in the same general vicinity as the thing it polices. No criticism intended — enforcement has to run somewhere. But it means every one of those locks is, in principle, reachable by the same class of attack that compromises the agent. We saw the live version of this problem just last week at Hugging Face, where an autonomous agent system ran a full intrusion straight through infrastructure that had plenty of software controls in its way.

The hardware signer breaks that symmetry. Think of the difference between a rule in your accounting software that says payments over $10,000 need approval, and the company checkbook locked in a physical drawer. The software rule is exactly as strong as the software — compromise the system and the rule is yours to edit. The drawer does not run code. An attacker who owns your agent, your laptop, and your cloud account is still standing outside a piece of dedicated silicon whose only job is to display a transaction and wait for a thumb.

Crypto people will shrug at this — hardware signing has protected their keys on precisely this principle for a decade. What is new is pointing that architecture at agents: keeping the productivity of a machine that reads, analyzes, and prepares at machine speed, while pinning the moment of irreversible commitment to an air-gapped device. It also rhymes with something I noticed three days ago about the Codex Micro: the supervision layer for autonomous systems keeps reaching for physical objects. OpenAI built a hardware status board so you can see what your agents are doing. Ledger built a hardware veto so you decide what they finish. Legibility and authority, both migrating off the screen.

The honest caveats

Who is this for? Right now: teams whose agents touch crypto rails — treasury operations, payments experiments, anyone wiring an agent to a wallet, and the enterprise multisig tooling suggests Ledger is aiming well past hobbyists. Who is it not for? Almost everyone else, today. If your agents touch Stripe and QuickBooks rather than on-chain wallets, there is nothing here to install — though I would argue the pattern is the most portable thing in the box, and the fact that Ledger also positions its devices as physical security keys for GitHub, Discord, and 1Password tells you they see the bigger market too.

And the model has a load-bearing weak point, which is the thumb. A hardware confirmation is only as good as the attention behind it. If your agent proposes four transactions a day, the device screen gets read. If it proposes two hundred, the tap becomes ritual — and you have rebuilt, at the hardware layer, the exact rubber-stamp problem I wrote about when a thousand machines converged on one tired reviewer. Crypto has a name for the degenerate case — blind signing — and it has been the industry's chronic disease for years. Hardware enforcement fixes who can authorize. It does nothing, by itself, for how carefully.

The takeaway

The lock question now has three answers on the table: in the harness, in the protocol, and off the machine entirely. They stack rather than compete — the RFCs authenticate the caller, the control plane scopes the action, and the hardware anchors the final commitment somewhere no injection can follow. If your agents will ever touch money, the design worth stealing from Ledger is the strict propose/execute split with the execute half physically displaced.

The question I am watching: does "hardware enforces" jump the rails and become a general category? Somewhere between the Codex Micro's status lights and Ledger's signing screen, there is an obvious product — a desk object through which agent actions above a risk threshold must pass, whatever the rail. The first vendor to ship that for ordinary business payments will have taken the oldest idea in banking, the signature that must be made in person, and given it a USB-C port.