Skip to content
Menu

Agents

Let agents act. Keep humans in control.

When an agent reaches a boundary you define, Identizen sends the exact action to the person's phone for biometric approval, and the agent continues only with a signed approval in hand. Give agents authority without giving them your authority.

The flow

  1. 01 · AI agent

    Purchase 500 units from Vendor X for $14,200

  2. 02 · Your application

    Policy says: human approval required above $5,000

  3. 03 · Identizen

    Pushes the request to the person’s phone

  4. 04 · Phone

    Approve purchase? Vendor X · 500 units · $14,200 · [ Face ID ]

  5. 05 · Signed approval

    Assertion bound to that exact text, verified by the index and returned to your server

  6. 06 · Agent continues

    or stops, with a record either way

How it works today

A tool boundary and one API call.

This is the Verification API that already powers step-up for wires and deploys, called from the place in your app where an agent's tool call becomes a real action. No new protocol, no agent SDK to adopt.

Scoped standing grants, so a person can pre-approve a class of actions up to a limit and skip the prompt for each one, are on the roadmap and will be specified in the protocol before they ship.

Verification API reference
tools/purchase.ts 
// A tool boundary in your app. The agent calls it; your server decides and composes the text.
import { createIdentizenServer } from '@identizen/sdk/server';
const idz = createIdentizenServer({ indexUrl, clientId, clientSecret });

export async function purchase(agent: Agent, order: Order) {
  if (order.total > policy.autoApproveLimit) {
    const v = await idz.verify({
      sub: agent.owner.idzSub,
      reason: `Let ${agent.name} buy ${order.qty} units from ${order.vendor} for ${money(order.total)}?`,
    });
    const done = await idz.waitForVerification(v.verification_id);
    if (done.status !== 'approved') return { ok: false, reason: 'not approved by owner' };
  }
  return vendor.placeOrder(order);
}

Why it holds up

Four rules that make it safe

  • The agent never writes the prompt

    Your server composes the text from the order it is about to execute. A prompt-injected agent cannot ask for one thing and do another, because the person approves what the server will do.

  • Approval happens off the agent’s screen

    The request goes to the phone, not to the chat window the agent controls. There is no button the agent can press for the person.

  • There is a record

    The signed assertion names the site, the person, the action text, and the moment. The index verifies both signatures and writes an audit event, and the webhook that reports the result is a JWT signed with the index’s published key, so the outcome can be checked later.

  • Set the boundary, not the agent

    Decide which actions need a human: amounts, destinations, roles, deletions. Everything under the line runs; everything over it waits for a phone.

Identizen is an identity system that agents can use, not an agent platform. This page describes one use of the authorization primitive.

Put a person between your agent and the money.

Bind the owner's phone with the quickstart, then add one call at the boundary.

Read the quickstart Talk to us about agents