The authorization gap: a valid agent, but who authorized it?

"Find me the best auto insurance" is an ordinary instruction. Enrolling in a new policy, which is non-refundable, is a much bigger commitment.

Suppose an agent does the work, but you only requested information. It finds an insurance company, requests a quote, signs the agreement, and pays the premium.

The consumer later files a dispute with the insurance company. Yes, that's their agent. No, they didn't authorize it to sign a contract.

Everyone can agree on the owner's identity and still disagree about the transaction.

That's the authorization gap: the distance between knowing who the agent’s owner is and establishing whether or not they actually permitted this request.

It's easy to miss in a demonstration. The agent can automate the browser and click on any button, but how does the insurance company know the human behind the agent actually agreed to these terms?

What proves that the owner was aware of what the agent was signing up for? The insurance company does not see the chat; it cannot see what you told your agent. The company sees a completed request, but it has no way to tell whether you’ve actually approved. This puts their compliance obligations at risk, and it’s unclear whether this contract would hold up in a lawsuit if the insurance company can’t demonstrate that the owner approved.

Businesses receiving agent requests need to know not just who the human is, but that they approved this particular request.

Permission has to travel with the request

In this example, the insurance company is not privy to the chat transcript with your agent. It also can’t take the agent's word for what the owner meant.

With every request, the agent needs to provide the insurance company with evidence that the owner approved. It’s a record that identifies the person granting it, the agent receiving it, and the terms and conditions that the owner agreed to. Relevant conditions an owner might allow include an approved list of insurance companies, a spending amount, the policy, a time window, or the exact agreement being accepted.

Before accepting any request from an agent, the system has a concrete job: check whether the agent is allowed to make the request and whether it falls within the conditions the owner approved.

Put the check at the point where the business is about to make the commitment. If the evidence doesn't cover the action, the workflow should stop or ask for additional approval.

This record becomes a critical link that binds the agent’s action with its owner’s intent. It’s what gives the agent a permission slip to include with every request. And this record can be inspected by any organization that receives it.

We already know why people sign things

Think about the insurance company asking a customer to sign a new policy. The form identifies what's being insured, the premium price, and the terms. The customer signs, and the insurance company keeps a copy.

Months later, if the customer says, "I never agreed to pay for this policy," the insurance company can pull out the agreement. There is something specific to examine: the terms, the signature, and the evidence of how the agreement was made.

The signature doesn't prevent someone from disputing it. It gives both parties evidence to bring to the dispute.

We kept that basic arrangement when forms moved online. Whether on paper or digitally, a person always signed. Now the agent is signing on the user’s behalf, which breaks the connection and disintermediates the user from the obligation. How do we know the agent did use the wrong person’s information? Or how do we know the agent asked the user first, before clicking on “I agree”? The connection that binds a person to a particular set of terms is therefore broken.

Agents need to preserve that connection. Any service should be able to ask for the equivalent of the signed approval, even when the request arrives through an API and no PDF exists. The owner can provide approval in the form of a payload that is signed. It’s data that can travel with the agent's request and carry the same essential evidence: who approved what.

Turn the owner's intent into something you can verify

Intent is what the owner wants the agent to do, including the conditions they place on it. Verifiable intent is evidence of that expressed instruction, bound to the owner so the recipient can check where it came from and whether it has changed.

A verifiable record is the artifact carrying that evidence. It's an identity and authorization payload: the owner's verified identity, the approved terms or instructions, and the signatures that connect them.

For the insurance example, an illustrative instruction could be: "This agent may open a new policy with any insurance company, up to $5,000 in price per premium. It may not accept a policy without a right-to-cancel clause. This permission expires on Friday."

The owner reviews and signs those instructions. The insurance company checks the agent's actual order against this record before accepting it.

If the agent submits a request, the system must reject it if the owner's permission is missing. If the agent rewrites the permission and falsifies it, the signature no longer validates against the changed data.

Approval must come through a process that authenticates the owner and keeps signing control separate from the agent's ability to generate a request. Otherwise, the agent could manufacture the very evidence the service provider is relying on.

That's the distinction that matters. The agent may choose how to complete the task within its authority. It cannot rewrite the owner's authority and pass the changed instruction off as the original approval.

There is already work underway on the format of these instructions. Google's Agent Payments Protocol uses signed mandates for payment intent and approval. This is a general format for a verifiable record that can cover other industries and use cases, not just credit card purchases.

The preservation of this record is what helps protect companies from what happens next.

Keep the evidence after the agent moves on

Now move the story forward a year. The agent conversation is long forgotten. The customer disputes the policy, and your team needs to explain why it accepted the request.

Your system should be able to retrieve the owner's signed permission, the identity evidence, and the submitted order. Your acceptance record should show that the user did, in fact, authorize their agent to apply for this policy. That’s the proof.

Being able to demonstrate that the user was aware of what the agent was doing and actually approved is the legal record you need. An approval flag in a database won't tell the whole story.

The record also has to be usable by people. Your dispute team, counsel, or a judge needs an accurate rendering of the terms, backed by the signed data, rather than a transcript of the chat (which has long been deleted).

This is the authorization gap. Years later, how does one prove that the owner actually agreed to this agent’s action? Without this record, disputes could land in front of a judge with no ability to know who’s right and who’s wrong. A verifiable record can be preserved with every agentic transaction so it can be examined in the case of any dispute.

Without this record, any organization receiving an agentic transaction faces significant liability. This is why organizations like Insurify and Amazon are blocking agents like Muse. More and more organizations will not have any defense when six months later, every consumer comes calling to say “it wasn’t me” to get a refund on their policy.

Give the business the owner's signed authority

Proof's Certify solution binds a verified person's identity to specified transaction terms. Our support for verifiable intent extends that approach to defined authority an agent can present when it acts.

This is the authorization gap we need to close. The owner's permission must survive every handoff between the person giving the instruction and the business carrying it out.

The next time an agent signs an agreement in a demo, ask to see the owner's authority. Then ask what record you'll have a year later if that owner says they never agreed.

You should be able to produce the approval they gave, with the terms intact.

Review Proof's delegation model.