AI agent security starts with knowing who approved the action

AI agent security controls what an autonomous agent can do once it's connected to real business systems, where it can send money, delete data, or change access. It covers least privilege, input validation, monitoring, and approval at high-risk points. TAG closes one gap in that list: proving which human approved.

Two matter most. A hijacked agent is steered by attackers through prompt injection, poisoned context, compromised tools, or stolen credentials, while looking normal. A well-meaning agent acts too broadly or without enough context. Either way it acts on a human's inherited permissions, and any approval step is only as strong as the proof of who answered.

Prompt injection hides instructions in content the agent reads, like a web page, document, or support ticket, to redirect it. Filtering reduces it but can't guarantee it, because the manipulation happens inside the agent's reasoning. That's why high-risk actions need an approval step outside the agent, confirmed by a named person.

Token for Agents and Gateways (TAG) is the biometric human-approval control for agentic AI. When your gateway escalates a high-risk action, a verified human approves or denies that exact action with a fingerprint on a TokenCore™ device. TAG returns the decision with a signed record of who approved what.

Human in the loop means a person is asked before an action runs. It doesn't say how that person is verified. A push tap or a chat button proves an account responded, not which human. TAG adds that proof: a fingerprint on hardware, bound to the action, with a signed record.

Review agents and guardrails judge whether an action looks safe. They don't prove who authorized it. TAG doesn't score or filter. It records a verified human's decision on what your policy escalates.

Your policy decides. Most actions stay automated: reading, drafting, summarizing, recommending. Approval belongs on actions that harm the business if the agent gets them wrong: sending money, deleting data, changing access, releasing confidential information, or changing production.

Least privilege comes first. Better permissions would have prevented several documented agent incidents with no approval step at all. Approval adds to least privilege; it doesn't replace it. NIST SP 800-171 already covers "processes acting on behalf of authorized users", which includes AI agents as written.

The approver's fingerprint is matched on the TokenCore™ device, which authorizes the hardware-bound key in the EAL5+ secure element to sign. TAG checks the signature, confirms the device is genuine through FIDO Metadata Service attestation, and checks it matches the exact action. The signed assertion carries a user-verification flag: cryptographic evidence that a human was biometrically verified at that moment.

Not when approval stays rare. Routine actions stay automated. Only the few that can't be undone wait for a person, and approvals run asynchronously, so nothing is held open while they respond.

It fails closed. No verified approval, no action.

Five steps. Connect TAG to your gateway through the API or an MCP tool. Federate approver identity from your IdP over SSO (OIDC/CIBA). Enroll approvers on TokenCore™ devices, reusing FIDO2 enrollments you already have. Set which actions need approval. Point the signed records at your SIEM. Most teams have a first approval running in days, not months.

No. A hijacked session is a hijacked session, whatever the authentication method. Governing the session is the job of your IdP and PAM layer. TokenCore™ decouples the credential from the endpoint and makes it simple to re-prove human presence at the point of consequence.