Being woken up by a phone call in the early morning is never a good thing. This time it was worse—an AI trading module from a certain quantitative team went out of control, clearing 12 staking pools in 10 minutes. Risk control stopped the major losses, but still, 870,000 dollars ran to the other side of the cross-chain bridges.

After hanging up the phone, I stared at the ceiling for a long time. I just read Kite's technical documentation last week, and now this situation vividly confirms a question: how should the authority boundaries of AI agents be defined?

The current situation is actually quite absurd. We are granting AI agents permissions as if we were giving a program the bank vault password, all account private keys, and transfer whitelists. The theft of 3 million dollars in the Banana Gun incident essentially stems from a flaw in permission design. Over the past six months, the cumulative losses from such incidents have already exceeded 230 million dollars – this figure indicates that the problem is not an isolated case.

The solution approach of Kite is very straightforward: do not expect AI to always be obedient, but rather limit its "capabilities" from an architectural perspective.

They designed a three-tier identity system. For example: if you invite a chef to your home to cook, you certainly wouldn't give him all the keys to your house. The normal procedure is to issue a temporary kitchen access card, which is only valid during working hours, can only open the refrigerator and stove, and records each entry and exit.

Corresponding to the Kite system: the user identity is you as the homeowner, the agent identity is equivalent to the chef's professional qualification certificate, and the session identity is that temporary card with a time and area limit.

The most critical aspect is the design of the "session" layer. Before the AI executes a task, the system generates a short-term session permission —