AI agents can act. Humans should authorize.
Agents are moving from answering questions to taking actions. The question a business has to answer is no longer only who the customer is, but whether a real human approved what just happened.
How do you keep a human in control of what an AI agent does?
Let the agent handle the routine work, then return to a verified human at the moments that carry consequence — confirming identity, choosing between options, and authorizing payment. Each approval covers one specific action with its cost stated, instead of giving the agent standing credentials.
AI needs boundaries, not unlimited credentials.
Most agent integrations today work by handing software the customer's own access. That is convenient, and it is exactly the wrong shape.
Credentials are permanent
A stored credential keeps working long after the task it was granted for has finished, and it covers every action the customer could take.
Intent disappears
A logged-in session proves someone signed in at some point. It says nothing about whether the customer agreed to the specific action that followed.
Authorization is scoped
One action, one amount, one moment, with an expiry — small enough that both sides can say precisely what was agreed.
Identity. Intent. Authorization.
Three questions, in order, for any action an agent proposes on a customer's behalf.
Who is approving?
Establish that a real, known human is on the other end of the approval — not a session token an agent inherited.
What exactly is being proposed?
Show the specific action, its cost and its consequence in language the customer can check in a few seconds.
Did the human agree to that consequence?
Capture explicit approval of that action, bound to that moment — not blanket permission for everything that follows.
AI can prepare the action. The human authorizes the consequence.
Routine work runs free. Consequences come back.
An agent should not need permission to look something up. It should always need permission to commit the customer to something.
Identity
Before an agent can read or change anything that belongs to a customer, confirm the human.
Decision
When there is a real choice with real consequences, the human chooses — the agent prepares the options.
Transaction
When money moves, the human authorizes that amount for that action. Nothing standing, nothing implied.
One task, start to finish.
A customer asks their own agent to change a flight. Watch where the human stays in control.
The customer delegates a task
“Change my flight tomorrow. Keep me in the same cabin and don't spend more than $150.”
The itinerary, fare and amounts above are fictional sample data. No airline, brand or payment provider is represented, and this flow describes intended functionality that is not built today.
Six actions that should never be automated away.
These are the boundary operations Assure is building toward. None are built today.
Authenticate
Prove the human behind the request.
Authorize
Capture approval of one specific action.
Pay
Confirm a payment without handing an agent card details.
Consent
Record what the customer agreed to share or allow.
Share
Release only the data the action actually needs.
Escalate
Hand off to a person with the context intact.
Two agents can negotiate. One human decides.
A conceptual architecture, not a shipping product.
An AI agent shouldn't need your credit card number to buy something for you.
Automation shouldn't mean losing the human.
When an agent reaches the end of what it should decide, the handoff has to carry everything a person needs to pick up the thread.
What an authorization record could contain.
Described so your architects can plan against it. None of this exists as a shipping artifact today.
- · Authenticated identity reference
- · The requested action
- · Authorization scope
- · Timestamp
- · Channel used
- · Transaction context
- · Session binding
- · Expiration
- · Verification metadata
No authorization artifact, cryptographic signing or verifiable receipt exists in the product today. Nothing on this page should be read as a shipping API, and no agent platform, payment provider or identity vendor partnership is claimed.
Plain status, no hedging.
We would rather you plan around the truth than be surprised by it.
The verification experience
The opt-in and code walkthrough at /verify is a labelled simulation. No messages are sent.
Authentication foundations
Passkeys, one-time codes, step-up challenges and verified messaging are in development, not generally available.
Everything on this page
Agent authorization, scoped approval, transaction authorization and agent-to-agent commerce are reference architecture.
Frequently asked.
Agents do the work. Humans stay in control.
Authentication for today. Authorization for what's next.