NIST got 650 replies on how to prove who approved an AI agent task
Speakers at the Authenticate 2026 conference tell that a passkey or a password cannot show who approved a task.
At the Authenticate 2026 conference, speakers tell that AI agents must have traceable proof of who approved each task. NIST, a US government agency, got about 650 emailed replies to its February concept paper on the matter. NIST at this time looks for baseline requirements. The company iProov made open source software for human approval.
What is new
iProov made HAPS, the Human Approval and Presence Specification, open source. It uses proof that an agent cannot give, such as a live face. It is used to show that a human approved a task. The company gave no test results.
The problem
Lawyer Judie Rinearson tells that, at this time, the legal protection against agent fraud in purchases comes from credit card rules. Frances Zelazny of Prove tells that credit cards have no strong connection to an identity. Zelazny tells that a biometric bound to the account is the answer.
What is not known
Ryan Galluzzo of NIST tells that the community is divided on small or large changes to standards. The larger group wants small changes. The market must select which proof is necessary and when. Rinearson tells that regulation is necessary for long-term trust.
Insight: Many groups race to define proof of agent approval
World made a tool that shows an agent works for a human. Four companies showed an open check of agents, with an authority of Singapore. At this time iProov gives its method. NIST has no baseline at this time. This seems a race: the proof method that banks and regulators accept first can set the rules. Before you buy, find if a tool fits the standard that wins.
Sources
Posted