What Your Business Needs Before It Accepts an AI Agent's Request
In September, Meta introduced Muse, a personal AI agent it says was built to work for billions of people. Muse can fill out forms and negotiate on a person's behalf, and Meta says it checks with the person before sensitive actions like sending an email or making a purchase.
Moxxie Ventures founder Katie Jacobs Stanton had a different experience with another personal assistant, Instinct, which she said broke her trust when it sent an email for her without checking first. TechCrunch also reported that Instinct's terms let it enter into binding "agreements, commitments, or transactions" for its users. An unwanted email is embarrassing, while an insurance policy, a loan or a purchase the person never approved can leave them paying for it.
When an agent like Muse does ask first, the approval happens inside the agent. The business receiving the order or application sees the request without the conversation behind it, so if the customer later says they never agreed, the business has no record of its own to answer "Who authorized this?" Our eight-part Money20/20 series set out to answer that question for businesses, with three main points.
- Knowing which agent sent a request is a good start, and a business also needs to know which person is behind it and what that person approved.
- That approval should arrive with the request as a signed record the business can check before it acts and keep in case of a dispute.
- x401, the open protocol we built, lets any business ask an agent for that record before it says yes.
Recognizing the agent is a good start
If a request comes from a known agent like Muse, a business can be more comfortable than it would be with an anonymous bot. It still needs to know whether the person behind that agent agreed to this particular request. The owner's account may have been taken over, or the agent may have gone further than it was told. Our series also used a simpler case, where a child picks up a parent's unlocked phone and asks the assistant to buy something.
The checks most businesses already run help them understand who they're dealing with. A login shows someone had access to the account, and an ID photo or mobile driver's license helps establish who the owner is. Neither one shows what the owner approved for a specific purchase or application, which is why we argue that "know your agent" has to reach the person behind the software.
The approval needs to arrive with the request
In the concert ticket example from our sixth article, a person tells their agent to buy two tickets for no more than $300, including fees. The agent finds seats for $290, the total climbs to $382 at checkout, and the agent buys them anyway. The card works and the agent is legitimate, yet the purchase goes past the limit the person set.
We think the answer is a signed approval the person gives in advance, stating which agent can act, what it can do, how much it can spend, and when the permission ends. The business checks the agent's request against those terms before accepting it, and if anyone changes the terms, the signature no longer matches. If the customer disputes the charge months later, the business can look at the approval itself instead of a chat history that may be long gone. We call the distance between knowing who the owner is and knowing what they actually permitted the authorization gap.
The person's digital ID has to hold up
Two digital IDs can carry the same name and look equally official, even though only one came from checking the person against a federal identity standard. A bank asks us some version of this every week, and we suggest three questions before accepting any credential. How was this person verified? Is the credential authentic and still valid? Does accepting it meet your regulatory obligations? We hold our own digital ID to the same test, and it's certified by the Kantara Initiative against the federal NIST standard for verifying identity.
Trust has to run both ways
A fake invoice with the right amount and different bank details can fool an agent too, leading it to pay the wrong company while following its owner's instructions exactly. That's why we verify businesses as well as people, so a company can sign the invoices and requests it sends and an agent can confirm where they came from.
When a customer does say "it wasn't me," signed records help show what actually happened, including whether the agent went past what its owner approved. Deciding who pays still takes shared rules about who checks each record and who answers for a missed check, so we're building this as a network with operating rules that every participant agrees to.
How x401 answers "Who authorized this?"
x401 is an open protocol we built so any website or app can ask an agent who is behind it before it acts. It runs over the same web connections businesses already use. When an agent asks to do something that needs approval, the business replies with a request for proof. The agent sends back a credential showing the verified person it works for, along with that person's signed approval and its limits. The business checks both, goes ahead only if the request fits, and keeps the record in case of a dispute.
A business can also sign its own request for information, so the agent can confirm who is asking before it shares anything about its owner. x401 is one part of the identity authorization network we're building, which also includes fraud monitoring through Defend while a transaction is still in progress.
Why now
Muse is rolling out across the US, and Cloudflare reported that non-human traffic passed half of what it saw in 2026. Some businesses responded by blocking agents, and Insurify was among those that blocked Muse. Insurify has since launched an AI Agent Gateway that lets shoppers send their own agent to compare quotes, with rules for consumer consent and for how agents identify themselves.
Blocking made sense early on, and the businesses now building ways to let agents in will each face the same question about the person behind each request. A business that can answer it can take on agent traffic with a record it can stand behind.
Read the full series
When an agent's request carries the person's verified identity and their signed approval, a business can say yes and explain that decision later. The person gets help with the errands they keep putting off, without a commitment they never made.
.png)
.jpg)
