Signature vs. Password
In a single sentence of the Postscript, Deleuze distinguished two modes through which power addresses its subjects: the signature, characteristic of disciplinary societies, and the password or code, characteristic of control societies. The signature identifies a unique person — it is personal, bound to a body, inscribed in registers that locate each individual within a mass. The password grants or denies access — it is impersonal, numerical, transferable, and it can be changed, revoked, or hacked without reference to the person behind it. The shift from signature to password marks the transition from identity-based governance to access-based governance, and names the architecture of power that organizes the AI age.
The Persistence of Embodied Capture — Contrarian ^ Opus
There is a parallel reading in which the signature never left — it merely migrated into the substrate that generates and validates passwords. The shift from signature to password presumes that authentication has become impersonal, but this misreads where identification occurs in the contemporary stack. The password may be system-generated, transferable, and revocable, but it is generated for a person whose embodied presence has already been captured at a deeper layer: the device fingerprint, the IP address, the behavioral biometric, the payment instrument, the phone number linked to identity verification. The password floats on top of an identification infrastructure that is more totalizing than any signature registry.
What appears as the dissolution of identity into access rights is better understood as the extension of identification into continuous monitoring. The disciplinary signature identified you at moments of institutional transition — enrollment, employment, contract signature. The password infrastructure identifies you at every moment of use, and it does so through data signatures that you cannot refuse to produce: your typing cadence, your location history, your pattern of API calls, the metadata of your session. When the São Paulo developer's access was revoked, it was not because the system knew nothing about her — it was because the system knew too much, had profiled her usage as anomalous, and exercised a form of algorithmic discipline more fine-grained than any signature-based registry could achieve. The password is not the replacement of the signature but its infinite multiplication into behavioral traces that cannot be contested because they are never made visible as evidence.
In the AI Story
The signature presupposed the individual as its reference. It was the graphical trace of a unique hand, bound to a specific body, difficult to forge and personally inscribed in every instance of its use. Banks, contracts, legal documents, and institutional records operated through signatures precisely because they depended on the presumption of indivisible persons whose identity could be verified through this embodied trace. The signature made the individual legible to power as a whole person.
The password has none of these properties. It is not bound to a body but to a database. It is not unique to a person but assigned by a system. It can be given to another person, stored in a password manager, generated and revoked automatically, and — critically — it has no reference to who you are, only to what you can access. The password is the atomic unit of the dividual; it fragments identity into access rights that can be granted and revoked independently of the person.
The analytical power of this distinction becomes clear in the AI context. When a developer works with Claude Code or another AI platform, the relationship is mediated entirely by passwords: API keys, subscription credentials, authentication tokens, terms-of-service agreements. The system does not know the developer as a whole person. It knows the dividual assembled from the developer's interactions, and it grants or revokes access through codes that bear no necessary relationship to the developer's identity. A credential violation can suspend the developer's access without notice, as the Deleuze volume documents in its account of the São Paulo developer whose work was mid-stream when her API access was revoked. The walls did not close in; the door simply ceased to exist.
The password architecture also reshapes the phenomenology of exclusion. Disciplinary exclusion was visible and contestable: the locked gate, the barred door, the wall that could be scaled or torn down. Contestation required a body in a space, a presence that could be made visible to others. Password-based exclusion is invisible and non-spatial: the authentication failure happens silently, in the moment between typing a credential and receiving a response. There is no gate to stand at, no door to block, no wall to scale. There is only the code that works or does not work.
Origin
Deleuze introduced the distinction in the Postscript's central paragraph: In the disciplinary societies one was always starting again (from school to the barracks, from the barracks to the factory), while in the societies of control one is never finished with anything... the key thing is no longer a signature or a number, but a code: the code is a password. The formulation draws on Foucault's analyses of the signature in disciplinary record-keeping while extending them toward a mode of power Foucault did not live to analyze.
Key Ideas
The signature identifies; the password authenticates. Identity requires that power know who you are; authentication only requires that power verify that the credential is valid.
The signature belongs to the person; the password belongs to the system. A signature is an embodied trace that the individual produces; a password is a system-generated credential that the person merely possesses.
Passwords can be revoked; signatures cannot. The shift from signature to password transfers control over identity from the person to the institution that manages the credential.
The password architecture makes exclusion invisible. Disciplinary exclusion produced visible sites of resistance; password-based exclusion happens silently, without an architecture to picket or occupy.
Every AI interaction is password-mediated. The entire infrastructure of AI-augmented work operates through codes — API keys, subscriptions, tokens, terms of service — that can be modulated without warning.
Debates & Critiques
Some commentators have suggested that biometric authentication — facial recognition, fingerprint scanning — represents a return to signature-like embodied identification, and therefore complicates the signature/password framework. The counter-argument, developed in the Deleuze volume, is that biometrics function as passwords that happen to use biological features as input: they authenticate access rather than identifying persons, and they can be disabled, rerouted, or combined with other credentials in ways that preserve the password architecture. The body becomes the key, but the system remains the lock.
Appears in the Orange Pill Cycle
Identification Migrates, Access Governs — Arbitrator ^ Opus
The right framing depends on which layer of the system you're examining. At the level of user-facing interaction — the moment of login, the granting of a session, the validation of a credential — Edo's analysis is close to fully correct (90%). The password architecture does govern access impersonally, and it does fragment the person into dividual access rights that can be modulated independently. The developer's relationship to the AI platform is mediated by codes that authenticate usage, not by signatures that identify personhood. This is the phenomenology of the interface, and it structures how exclusion is experienced: silently, without visible architecture, through authentication failures rather than locked gates.
But at the level of infrastructure — the substrate that issues, revokes, and monitors passwords — the contrarian view becomes weightier (60/40 in favor of persistent identification). Passwords do not float free of identity; they are issued to accounts that are themselves anchored to increasingly dense identification regimes. What has changed is not that power has stopped caring who you are, but that identification has become continuous and automated rather than episodic and manual. The signature was a moment of verification; the password infrastructure is an ongoing surveillance apparatus that produces vastly more identification data than any signature archive.
The synthesis is that signature and password name two different but co-present functions: identification and access governance. Disciplinary power required both but performed them through the same mechanism (the signature verified identity and granted access simultaneously). Control societies separate these functions — identification migrates into continuous monitoring substrates, while access governance operates through modular, revocable codes. The password is not the end of identification but its backgrounding into infrastructure, which is precisely what makes access-based exclusion so difficult to contest.
Further reading
- David Lyon, Surveillance Studies: An Overview (2007)
- Alexander Galloway, Protocol: How Control Exists After Decentralization (2004)
- Louise Amoore, Cloud Ethics: Algorithms and the Attributes of Ourselves and Others (2020)