At the Raise Summit in Paris, I caught up with Richard Kirby, Office of the CTO at 1Password.
We sat down to discuss why passwords haven’t disappeared, where passkeys still stall in practice, how engineering teams should approach service accounts and AI agents requesting tool access, and what building secure, developer-friendly secrets management actually looks like today.
We’re seeing the cybersecurity world gradually move from old-school passwords to passkeys. That shift is exactly why I asked Richard how 1Password (a company built around password management) is approaching the change and adapting its broader strategy.
The company is actively pushing that transition: a few years ago, 1Password acquired Passage specifically to speed up passkey adoption. Today, the platform supports both passwords and passkeys, though Richard expects the shift to happen slowly:
Passwords are not going away. In some ways, we would love passwords to go away because passkeys are obviously a more secure option. However, passwords remain so prevalent that every system still relies on them.
He says this change affects credentials overall, not just user passwords. “In the age of AI, managing credentials has become very important. AI doesn’t use a passkey itself, but it still needs credentials to access certain resources”.
That’s why 1Password sees passkeys as an important part of the modern tech stack. Passwords are still here, but the focus is shifting more toward AI and managing credentials for AI agents.
When I asked what technical hurdles are preventing passkeys from becoming the new standard, Kirby said platform vendors first have to rewrite how they handle authentication:
Introducing passkey technology requires people to go back and retrofit their existing platforms, which creates the biggest hurdle.
From a user’s perspective, passkey setup can be confusing because vendors handle it so differently: some require multiple passkeys, others replace passwords entirely, and some do both. That inconsistency is still slowing down wider passkey adoption.
As engineering teams automate more infrastructure, I wanted to understand how they should think about non-human identities, like service accounts and AI agents.
Richard was especially excited about a feature his team recently launched: a dedicated part of the product that helps developers manage local secrets safely:
Initially we built the 1Password Environments feature to help developers keep credentials out of local disks and .env files. It uses FIFO pipes, which lets us avoid writing credentials to disk.
This setup also solves a big security problem for AI. You should never give raw credentials directly to an autonomous AI agent, since they can end up in logs or other places you can’t control. This feature lets apps access credentials securely while keeping you in control:
When an agent wants to use plugins for Cursor, Claude, or other major platforms, 1Password notifies me and says, “An agent wants access to data.” I approve the request, and 1Password supplies the credential to the authorized application so it can complete the sign-in, without exposing the raw secret to the agent. That’s a huge step forward. We don’t see this as the end goal, but it is an extremely valuable tool for working with AI agents in a secure environment.
Richard calls this mechanism “Securing the Stay,” and sees it as a major breakthrough in connecting cybersecurity and AI.
But that raises a new question: once the agent is inside, what can it do, who approved it, and how much can it do on its own? That’s why these systems need governance, policy, and oversight.
No one has solved it fully yet, but the whole industry is moving in that direction.
We see the biggest transformation for users right there: Securing the Stay and establishing full compliance to provide complete control and guarantees over what an agent can access.
1Password tries to keep its user experience simple, and its Director of Product Management strongly believes in that approach:
I have always believed that if you make someone’s job easier, they will do it. The cybersecurity industry as a whole holds a reputation for overcomplicating things. People often perceive passkeys as overly complex, so they run away from them.
For Richard, being developer-friendly means helping people get things done quickly and simply, without extra complexity. As a developer himself, he values tools that reduce friction and work reliably.
To wrap up our interview, I asked Richard Kirby which identity primitive he would prioritize first if he had to design an access management layer for a startup today.
Without hesitation, Richard chose least-privilege access.
The principle of least privilege has always underpinned good security, but teams have always struggled to apply it. Returning to my previous point: if you make it simple, users will reap massive benefits.
