Why isn't a biometric match enough to approve an AI agent's action?

A match proves pattern recognition, not presence, liveness, or decision: the sample could be replayed or injected, and even a live match says nothing about whether the person deliberately approved the specific action's details.

What is the difference between user presence and liveness in WebAuthn?

WebAuthn's user presence test is an interaction with an authenticator, typically a touch, explicitly not a physiological measurement; liveness detection establishes the sample came from a living person at capture, a separate claim needing separate evidence.

What does action-bound approval mean for AI agents?

The confirmation binds to the specific action's facts, file, recipient, amount, permissions, drawn from the same structured description the execution service enforces, so any post-approval mutation triggers a new decision, the PSD2 dynamic-linking pattern generalized.

When should an AI agent require fresh human approval?

On consequence triggers: irreversible actions, data or money leaving the organization, and expansions of the agent's own authority, with routine activity proceeding under scoped mandates, because constant prompts breed the approval fatigue attackers exploit.

What should an agent approval record contain?

The action's bound details, the verification outcome, presence, liveness, intent, and whether this was a fresh confirmation or standing delegation, without raw biometric samples, which stay local per the WebAuthn model.

Back to News

The Deep Brief · Oct 16, 2026 · 4 min read

When an AI agent asks for approval, who proves the human?

A biometric match is not human approval: an industry analysis maps what proof of presence must mean when AI agents request sign-off on consequential actions.

Rosalie Chirip

Senior Editor at deepidv

A hand holding a glowing phone in a dark room, the moment an AI agent's approval request reaches a real person.

The agentic era's hardest small question just got its sharpest public treatment. In an industry analysis for Biometric Update, ApexTransform founder Stéphane Gervais dissects what proof of human presence must mean when an AI agent requests sign-off on a consequential action, and his opening scenario is the whole problem in miniature: an agent preparing to send a confidential file externally gets a successful biometric match against an employee's template and labels the transfer human-approved. The match proved a pattern. It did not prove the employee was present, that the sample was live rather than replayed or injected, or that the person deliberately approved this file going to this recipient.

The analysis's core move is separating three claims that product language habitually merges: recognizing a biometric pattern, establishing a living person's participation, and confirming their decision about a specific action. The standards already encode the distinctions for those who read closely: WebAuthn Level 3, a W3C Recommendation since August, defines its user presence test as a mere interaction, a touch, explicitly not a physiological liveness measurement; NIST SP 800-63B-4 distinguishes biometric presentation from authentication intent, requiring an explicit mechanism because a front camera can capture a face during ordinary use; and even proven intent to authenticate is not approval of particular business facts. Systems should say which of these they actually establish, and most do not.

Binding the approval to the action

The analysis's second half supplies the pattern this publication's readers will recognize from payments: the approval must bind to the action's specifics, or it authorizes nothing in particular. The precedents are PSD2's dynamic linking, where the authentication code is specific to amount and payee and any change invalidates it, and W3C's Secure Payment Confirmation, where the verifier checks that what was displayed, what was confirmed, and what executes all match. Transferred to agents: the approval screen derives its details from the same structured action description the execution service enforces, the agent cannot alter destination or permissions between confirmation and execution without triggering a fresh decision, and the test suite deliberately mutates approved actions, changed recipient, broadened permissions, substituted file, expired approval, expecting rejection each time. The dynamic linking lesson, written for card payments, turns out to be the agent era's approval grammar.

Two more design notes land close to home. Presence requests must stay rare and consequence-triggered, irreversible actions, data or money leaving the organization, agents expanding their own permissions, because constant prompts breed the approval fatigue NIST's guidelines now penalize, having dropped out-of-band code-comparison prompts for exactly that reason. And records must tell the truth: a fresh human confirmation is a different fact from an action executed under standing delegation, and logs that describe machine actions as human-approved are manufacturing future liability.

The convergence worth noting

The analysis lands where this publication's agentic coverage has been pointing all year: the HAPS pattern's checkpoints, the mandate architecture that scopes agent authority, and the governance alarm's finding that 87 percent of IT leaders saw agents exceed scope all describe the same missing joint, and Gervais supplies its mechanical specification: structural liveness proving the living participant, explicit intent distinct from capture, action-bound confirmation that execution services enforce, equal-assurance fallbacks, and records that distinguish delegation from fresh consent, with raw biometrics kept local and out of the approval record. That is a buildable list, and in the deepidv stack it is Arc's checkpoint design: the approval ceremony as a verification event, evidence included. The closing line of the analysis deserves to travel: the human interaction matters because it changes what the machine is allowed to do next.

Agent Approval and Human Presence FAQ

Why isn't a biometric match enough to approve an AI agent's action?: A match proves pattern recognition, not presence, liveness, or decision: the sample could be replayed or injected, and even a live match says nothing about whether the person deliberately approved the specific action's details.
What is the difference between user presence and liveness in WebAuthn?: WebAuthn's user presence test is an interaction with an authenticator, typically a touch, explicitly not a physiological measurement; liveness detection establishes the sample came from a living person at capture, a separate claim needing separate evidence.
What does action-bound approval mean for AI agents?: The confirmation binds to the specific action's facts, file, recipient, amount, permissions, drawn from the same structured description the execution service enforces, so any post-approval mutation triggers a new decision, the PSD2 dynamic-linking pattern generalized.
When should an AI agent require fresh human approval?: On consequence triggers: irreversible actions, data or money leaving the organization, and expansions of the agent's own authority, with routine activity proceeding under scoped mandates, because constant prompts breed the approval fatigue attackers exploit.
What should an agent approval record contain?: The action's bound details, the verification outcome, presence, liveness, intent, and whether this was a fresh confirmation or standing delegation, without raw biometric samples, which stay local per the WebAuthn model.