Solution · AI enforcement
Keep a person in charge of what an agent may not decide alone.
Refunds, transfers, merges and deletions should not be an agent's call. Mark them as sensitive and they wait for the person who answers for that agent.
Everything waiting on a person
Three queues that are never merged: requests to act as you, agents waiting to do something, and changes the platform proposes. Each has its own clock.
What changes
The problem as most companies have it today, and the same thing with AuthFI.
How it works
Each step, on the screen you would use.
Limits
Put a ceiling on every permission.
A permission carries its limit: a highest amount, an allowed list, a fixed value. Past the limit, the answer is no. A project rule can also send an action to a person before it runs.
Highest and lowest amounts
Allowed and refused lists
Checked by AuthFI, not by the agent
Approval
The owner sees exactly what is being asked.
The request says which agent, acting for whom, wants to do what, and with which details. The owner approves or refuses.
A token bound to that one action for 60 seconds
Approve or refuse, with the details in view
The agent waits; it cannot move on
OpenID CIBA
Asked out of band, on a published standard.
An agent acting for a person asks through OpenID CIBA: the request goes to that person on a separate channel, and the agent polls until they answer.
Backchannel authentication, poll mode
The person answers away from the agent
Pending, approved, refused or expired
Read on
The parts of the product behind this.
Approvals guide
The three calls, with examples
OpenAI Auth
How agent sign-in works
OpenSecurity and audit
The record of every decision
OpenMore in AI enforcement
AI Auth: govern AI agents in production
AI Auth gives every agent an identity, limits and an off switch, on open standards.
See howGive an agent a boundary it cannot leave
On the machine it runs on, an agent reaches only what you granted. Enforced in the kernel.
See howMCP gateway: control which tools an agent can call
One MCP gateway for every tool: per-tool grants, checked arguments, no shared credentials.
See how