ACTOR TRUST RECEIPT
Illustrative- Actor
- AI Agent
- Agent identity
- Verified
- Principal
- Verified organisation
- Authority
- Verified
- Requested action
- Inside delegated scope
- Human approval
- Not required by mandate
- Mandate status
- Valid
Proof of Authority
Proof of Authority is the agent-authorisation primitive of Proof of Actor: a proposed way to verify an AI agent's identity, bind it to an accountable human or organisation (its principal), check a requested action against the agent's delegated, revocable mandate, and record who is accountable.
The problem
Knowing which agent is not the same as knowing it may act
Agent identity answers "which agent is this?" That is necessary, and it is not enough. A merchant, bank or SaaS platform receiving a request from an agent also needs to know who authorised it, what that authority covers, whether the authority is still valid, and whether this particular action falls inside it.
Non-human identity programmes manage service accounts, API keys and workloads that belong to an organisation. Autonomous agents are different: they act for a principal, under a mandate that has limits, an expiry and a revocation path, and their actions can carry real financial and legal consequences.
Proof of Authority is designed to make delegation explicit and checkable, so legitimate agents can transact openly instead of imitating humans, and so relying services can say yes to agents with confidence.
What it establishes
What Proof of Authority is designed to establish
Agent identity
Which agent is acting, and who built or operates it.
Principal
The human, organisation or authorised service the agent represents: human-to-agent and organisation-to-agent binding.
Mandate and scope
Signed delegation with permissions, scopes, transaction limits, allowed counterparties and expiry.
Action in scope
Whether the action requested now is inside the delegated authority, evaluated per action.
Explicit intent
Where the mandate or the service requires it, proof that the human approved this action, at this time, under these conditions.
Revocation and accountability
Authority that can be withdrawn, and a record of who ultimately stands behind the action.
Evidence, from more than one signal
Capabilities Proof of Authority is being designed around include:
We publish what is established, not how. Scoring, signal weightings and detection techniques are not disclosed.
Example mandate
- Agent
- Procurement Agent #4812
- Principal
- Acme Corporation
- Authority
- Purchase SaaS subscriptions
- Maximum transaction
- $5,000
- Allowed vendors
- Approved vendor list
- Legal agreements
- Not authorised
- Authority expires
- 31 December 2026
Differentiation
Proof of Authority and adjacent approaches
| Approach | Answers | What it adds |
|---|---|---|
| Agent identity / signed agents | Which agent or operator is this? | Who authorised it, what it may do, and whether this action is in scope. |
| Non-human identity (NHI) | Which workload or credential is this, and what can it access? | Delegation from an accountable principal, per-action authority and intent. |
| OAuth-style delegation | Which scopes did a user grant an application? | Transaction-level limits, explicit intent and a portable attestation for third parties. |
| Know Your Customer / Business | Who is this customer or company? | Which agent acts for them, under what mandate, right now. |
API Preview
Verify agent authority (API Preview)
In the proposed API, a relying service asks whether a specific action is authorised, and receives the verification status of the agent, the principal and the mandate.
// Proposed API - illustrative only
POST /v1/authority/verify
{
"agent_id": "agt_48291",
"requested_action": {
"type": "purchase",
"amount": 420,
"currency": "USD"
}
}
// Conceptual response
{
"agent": "verified",
"principal": "verified",
"mandate": "valid",
"action_authorised": true,
"maximum_amount": 500
}Where it applies
Related use cases
FAQ
Frequently asked questions
What is Know Your Agent (KYA)?
Know Your Agent is the emerging practice of verifying AI agents before relying on them, analogous to Know Your Customer for people. Proof of Authority treats KYA as more than agent identity: it is designed to establish the principal, the mandate and its scope, whether the current action is inside it, revocation and accountability.
How do you verify an AI agent?
Verifying an AI agent means establishing which agent is acting, binding it to an accountable principal, and checking the requested action against delegated, revocable authority. Proof of Authority is designed to return that as an attestation a relying service can apply its own policy to.
How is this different from non-human identity management?
Non-human identity programmes govern machine credentials such as service accounts and API keys inside an organisation. Proof of Authority focuses on agents acting for a principal toward third parties, where the question is whether a specific action is authorised and who is accountable for it.
Can agent authority be revoked?
Revocability is a core architecture principle. A mandate is designed to carry an expiry and to be withdrawable by its principal, and a relying service checking authority should see that the mandate is no longer valid.
Does Proof of Authority replace agent payment protocols?
No. Industry protocols for agent payments and checkout address how agents pay and transact. Proof of Authority is designed to be complementary: evidence about who stands behind an agent and whether an action is inside its mandate, usable wherever that question arises.
- Every primitive returns its result inside the same Actor Attestation, so applications can combine them.
Tell us what you need to verify.
Proof of Actor is being designed with developers and design partners. Your use case shapes the API.