It was the approval.
I’ve seen teams burn weeks on brilliant architectures, only to watch them stall because someone needed a laptop to click ‘approve’.
Robinhood’s engineers weren’t just annoyed—they were blocked. Not by bad code. Not by slow CI/CD. But by a broken access workflow.
The old system? You needed a company-managed device. Period. No exceptions. If you were on a train in Tokyo at 3 a.m. and a production alert fired? Tough. You had to wait until your approver woke up, found their laptop, and remembered their password. And if they were on vacation? Good luck.
This wasn’t a policy. It was a liability.
Shreyas Sriram, the security engineer who led SERA, put it bluntly: "We wanted security to move at the speed of a startup, not a bank."
And he was right.
Robinhood runs a platform that never sleeps. Crypto trades at 2 a.m. in Berlin. Customer support tickets spike after midnight in California. A 15-minute delay in access isn’t an inconvenience—it’s a revenue leak.
So they stopped asking how to make approvals faster.
They asked: How do we make security invisible?
SERA Wasn’t a Tool. It Was a Mindset Shift
The team didn’t start by picking a vendor. They didn’t tweak Okta. They didn’t slap MFA onto Slack.
They built something new.
SERA—Secure Enhanced Remote Approval—isn’t an integration. It’s a protocol.
It uses passkeys. Not SMS. Not TOTP. Not hardware tokens. Passkeys. Biometrically bound, phishing-resistant, device-agnostic.
The magic? You don’t need a corporate laptop. You don’t need a VPN. You don’t even need to be on the company network.
Just open your phone. Unlock it with your fingerprint. Tap "Approve." Done.
And it’s not just for humans.
Automated jobs, AI agents, CI/CD pipelines—they all use the same interface. A service account with a passkey. No secrets. No rotating credentials. No hardcoded keys in GitHub.
The team didn’t just solve for "faster." They solved for "unbreakable."
How They Did It Without Burning Out
Here’s the thing people forget: this wasn’t a 6-month project with a dedicated team.
It was four months. And everyone had other jobs.
Sriram was still managing appsec triage. The cryptography team was hardening KMS. The infrastructure team was migrating to Kubernetes. Yet they met daily.
No status reports. No Jira tickets. Just Slack threads and whiteboards.
"We operated as a unified strike team," Sriram says. "We didn’t wait for permission. We just built."
They used AI—not to write code, but to write boilerplate. To generate test scaffolds. To auto-generate documentation drafts. That freed them to focus on the hard stuff: PKI design, threat modeling, session timeouts.
They didn’t just test it. They broke it.
Full design review. Pen tests. Production readiness review. Every step was documented, audited, and challenged.
And here’s the kicker: they didn’t build it for themselves.
They built it as a platform.
"Approval-as-a-Service," Sriram calls it.
Now, other teams are asking to plug into SERA for approving database migrations, secrets rotation, even cloud budget increases.
It’s not just access anymore.
It’s trust.
The Real Lesson: Security Is a Culture, Not a Gate
I’ve worked at companies where security was a wall. A firewall. A checklist. A team that said "no."
Robinhood didn’t build a wall.
They built a door.
A door that opens with your fingerprint.
The secret? Trust.
They trusted engineers to make the right call. They trusted crypto to deliver. They trusted AI to handle the grunt work.
And they stopped treating security as a cost center.
They treated it as velocity.
"We made security cheap," Sriram says. "Not because we cut corners. Because we removed friction."
That’s the difference.
You can have the most secure system in the world.
But if no one uses it, it doesn’t matter.
What You Can Steal From This
- Stop optimizing for compliance. Start optimizing for behavior.
If your engineers are circumventing your system, you’re not secure—you’re ignored.
- Passkeys aren’t just for login. They’re for approval.
Use them for anything that needs human verification. It’s the only authentication method that’s both secure and frictionless.
- AI doesn’t replace engineers. It removes their drudgery.
Let AI write docs, generate test cases, auto-label tickets. Free up your brain for architecture.
- Build for reuse.
Don’t build a one-off approval tool. Build a platform. Someone else will need it next week.
- Don’t wait for permission.
The best security innovations happen when engineers and security folks work side-by-side—no org charts, no approval chains.
The Aftermath
One engineering lead signed up for SERA in under two minutes.
His reaction?
"Wait, is that all?"
That’s the sound of security winning.
Not because it’s strict.
Because it’s simple.
And in a world where AI ships code in minutes, security that takes hours is the real vulnerability.
SERA didn’t just cut approval time by 20%.
It proved that security doesn’t slow you down.
It can be the reason you move faster.
The Source Wasn’t the Problem—The Process Was
Let’s be real: no one wakes up and says, "I want to make approvals slow."
But every company, at some point, builds a system that makes sense… until it doesn’t.
Robinhood’s old system? It was built when the company was smaller. When engineers mostly worked from the office. When approvals were a weekly ritual, not a real-time demand.
The system relied on Okta SSO, enforced device compliance, and required a corporate laptop with a pre-approved certificate.
That’s fine… until you’re debugging a crypto settlement error at 3 a.m. in Seoul.
No laptop? No approval.
No VPN? No approval.
No sleep? Still no approval.
The system wasn’t broken. It was outdated. And worse—it was invisible. Engineers didn’t complain. They just worked around it.
They’d ask a teammate to approve on their behalf. They’d use personal devices. They’d write scripts to auto-approve. They’d bypass the system entirely.
And that’s when the real risk started.
Security isn’t about the tool. It’s about the behavior.
If your engineers are bypassing your system, you’ve already lost.
Passkeys: The Only Auth Method That Doesn’t Suck
Let’s talk about passkeys.
They’re not magic. They’re not new. But they’re the first authentication method that’s actually usable.
No passwords. No tokens. No SMS codes that get intercepted. No hardware keys you lose in your backpack.
Just your phone. Your fingerprint. Your face.
And now? Your service account.
SERA didn’t just enable engineers to approve from their phones.
It enabled everything to approve.
CI/CD pipelines. Automated secrets rotation. AI-driven anomaly detection that needs human sign-off. Even cloud budget approvals.
All of it now uses the same interface: a passkey.
No secrets. No rotating credentials. No hardcoded keys in GitHub.
The team didn’t just solve for speed.
They solved for trust.
Because a passkey is biometrically bound. It can’t be phished. It can’t be replayed. It can’t be stolen.
And it’s device-agnostic.
You don’t need to be on the corporate network. You don’t need a VPN. You don’t need to be in the office.
You just need to be human.
Or, increasingly, you just need to be a service account with a key.
The Team That Built It Didn’t Have a Budget
Here’s the part nobody talks about.
They didn’t have a budget.
They didn’t have a team.
They didn’t have a project plan.
Sriram was still triaging alerts. The crypto team was patching KMS vulnerabilities. The infrastructure team was migrating from EC2 to EKS.
And yet—they built SERA in four months.
How?
They stopped treating security as a department.
They treated it as a shared responsibility.
Daily standups. No slides. No tickets. Just Slack threads with screenshots of whiteboards.
They used AI to generate test cases. To write documentation. To auto-fill Jira templates.
They didn’t ask for permission.
They just built.
And when they were ready? They didn’t wait for a release cycle.
They rolled it out to themselves first.
One team. One week. No fanfare.
And then? The other teams noticed.
"Wait—you approve from your phone?"
"Yeah. You too. It’s free."
That’s how it spread.
Not because someone mandated it.
Because it was better.
It’s Not About Access. It’s About Trust.
Here’s the truth: most access control systems aren’t designed to be secure.
They’re designed to be auditable.
There’s a difference.
You can have a system that logs every click, every approval, every keystroke.
But if no one uses it? It’s just noise.
Robinhood didn’t build a system that logged everything.
They built a system that earned trust.
They trusted engineers to make the call.
They trusted passkeys to be unbreakable.
They trusted AI to handle the boring stuff.
And in return? Engineers started asking for more security.
"Can we use SERA to approve database migrations?"
"Can we lock down secrets rotation?"
"Can we use it for cloud spend approvals?"
That’s the magic.
Security didn’t become a gate.
It became a tool.
And tools get used.
What You Can Steal From This (No Fluff)
- Stop asking for compliance. Start asking for behavior.
If your engineers are using personal devices to approve things, don’t punish them. Ask why.
- Passkeys aren’t a login feature. They’re an approval primitive.
Use them for everything that needs a human in the loop. No exceptions.
- AI isn’t your co-pilot. It’s your scribe.
Let it write docs. Generate test cases. Auto-label tickets. Free your brain for architecture.
- Build for reuse. Not for one team.
SERA wasn’t built for appsec. It was built as a platform. Now it’s used for secrets, budgets, and even HR approvals.
- Don’t wait for permission. Build in the open.
The best security tools are the ones that spread by word of mouth.
The Real Metric Isn’t Speed. It’s Adoption.
One engineering lead signed up for SERA in under two minutes.
His reaction?
"Wait, is that all?"
That’s the sound of security winning.
Not because it’s strict.
Because it’s simple.
And in a world where AI ships code in minutes, security that takes hours is the real vulnerability.
SERA didn’t just cut approval time by 20%.
It proved that security doesn’t slow you down.
It can be the reason you move faster.
