Trust Stamp has launched a product that asks bank customers to complete a live selfie check to approve each transaction an AI agent initiates on their behalf, so that the account holder’s present consent, rather than a stored credential or an earlier permission, authorizes the action.
On first use, the customer completes a biometric registration that creates a personal identity token. For later requests, the customer is prompted to take a secure selfie through SMS, email, a push notification or inside the relevant app. Proof-of-life and anti-spoofing checks, with optional device verification and other authentication protocols, are used to confirm that the account owner is present when approval is requested. The flow can be started either by the agent or by the financial institution.
In an integrated deployment, the authorization screen should show the specific action and its details before the customer completes the live check, so that the approval is tied to that request, Trust Stamp said. The company argues that a stored password or prior permission should not by itself count as proof that a customer knowingly approved a particular financial action, especially when an agent has been given broad access in advance or its behavior has been changed by error or manipulation. It calls the concept Knowing Consent.
Trust Stamp says its approach identifies the human customer rather than the AI agent. Arkose Labs, which is building tools to identify agents themselves, has listed as coming soon a Proof of Human feature that would require a person to confirm before an agent continues at a sensitive step.
The product combines processes covered by Trust Stamp’s existing patents with a new process the company is patenting, and is available for immediate use. Institutions can add it through Trust Stamp’s orchestration layer, which the company says more than 100 financial institutions have integrated, or through a single API call. In its announcement, Trust Stamp pointed to NIST researchers’ warnings against letting agents use customers’ credentials; NIST authors have since proposed design tenets under which each agent would be uniquely and cryptographically identifiable.
“Trust Stamp’s approach reflects the need for controls at the moment an AI-Agent acts,” said CEO Gareth Genner, adding that the approval step “can be implemented in a matter of days.” He said the process “is triggered within the institution’s own access and transaction policies, and with no significant changes to the flow of their authentication process.”
Sources: GlobeNewswire
–
By the ID Tech Editorial Team
