-
-
VerifyAgent — AI agents can plan freely, while sensitive actions require verified human authorization before execution.
Inspiration
As AI agents become more capable, they are starting to do more than just answer questions. They can draft messages, publish content, make purchases, update shared resources, and take actions on a user's behalf.
That creates a new trust problem: even if a user is logged in, should an AI agent automatically inherit all of that user's authority?
We built VerifyAgent around a simple idea:
AI agents can plan freely, but sensitive actions should require verified human approval.
Instead of treating identity verification as a one-time login step, VerifyAgent introduces verification exactly when an agent is about to cross a sensitive trust boundary.
What it does
VerifyAgent is a trust-aware authorization layer for AI agents.
A user can ask the agent to perform a task, and the agent first converts that request into structured actions. Those actions are then evaluated by a deterministic policy engine.
Low-risk actions, such as generating or editing a draft, can proceed immediately. Higher-risk actions, such as publishing content or performing an action on the user's behalf, require verified human authorization.
For example, in our marketplace demo, the agent can prepare a listing and suggest a price without verification. But when it attempts to publish the listing, VerifyAgent pauses execution and requires the user to complete Persona identity verification. Only after successful verification can the action proceed.
This creates a clear separation between:
- what the AI wants to do
- what the system allows it to do
- what the user has actually authorized
How we built it
The system is designed around a few core components:
Agent layer
The AI interprets the user's request and produces structured actions instead of directly mutating application state.Policy engine
A deterministic authorization layer maps each action to a required trust level. The model does not decide whether it has permission to execute an action.Persona verification
When an action requires verified identity, the user completes a Persona verification flow before execution is allowed.Action executor
Only authorized actions can change application state.Audit trail
VerifyAgent records the sequence of proposed actions, authorization checks, verification results, and execution outcomes so the user can understand what happened and why.
This architecture keeps AI reasoning separate from security-sensitive authorization logic.
Challenges we faced
One of the biggest design challenges was deciding where verification should happen.
Requiring identity verification for every interaction would make the product frustrating and unnecessary. On the other hand, authenticating only once at login would not provide meaningful protection for sensitive agent actions.
We solved this by using progressive trust: verification is triggered only when the agent attempts an action that crosses a predefined trust boundary.
Another challenge was making the authorization flow understandable to the user. We wanted users to clearly see what the agent was proposing, why verification was required, and whether the action was ultimately allowed or blocked.
We also had to make sure the AI itself was not responsible for security decisions. The model can propose actions, but the final authorization decision is made by deterministic application logic.
What we learned
Building VerifyAgent changed how we thought about AI safety at the application level.
We learned that authentication and authorization are fundamentally different problems. Knowing who the user is does not automatically mean an AI agent should be allowed to perform every action the user could perform manually.
We also learned that identity verification can be more useful when it is contextual. Instead of adding friction at the beginning of a session, it can be invoked only when the user's identity actually matters.
Most importantly, we learned that trustworthy agent systems need a strong boundary between reasoning and execution.
What's next
VerifyAgent currently demonstrates this idea through a focused marketplace workflow, but the authorization layer is designed to generalize.
The same approach could be applied to AI agents that:
- send emails or messages,
- modify shared documents,
- publish content,
- approve financial actions,
- manage enterprise workflows,
- or interact with other external tools.
As AI agents gain more autonomy, we believe systems will need better ways to verify not only who the user is, but also whether the user actually authorized a specific action.
Built With
- next.js
- openai-api
- prisma
- react
- sqlite
- tailwind-css
- typescript
