Human-Delegated Agent Authentication: Proving the Human Behind Your AI Agent

Shopping assistants, coding agents, research bots, browser-automation copilots — AI agents acting autonomously on a person's behalf are no longer a novelty. They are becoming a default part of how people use the internet. And every major bot-management vendor has responded the same way: by trying to classify agent behavior more accurately. Better fingerprinting, better session heuristics, better ML models trained to spot the tells of automation.

That approach answers the question "is this agent behaving like a bot?" It never answers a more basic one: who is this agent acting for, and who is accountable if it misbehaves? An agent that behaves perfectly humanlike is still, from a trust perspective, a black box — a piece of software with no owner attached, no reputation attached, and nothing at stake if it lies, scrapes, or defrauds.

A Different Question

APTOGON already solves proof-of-humanity for people: a short gesture, an anonymous DID anchored on Aptos, zero biometrics, zero PII. Human-Delegated Agent Authentication (HDAA) extends that same credential to the agents people deploy. Instead of asking a site to judge an agent's behavior in isolation, HDAA lets a verified human vouch for it directly — cryptographically, with an expiry, and revocable at any time.

The idea is simple: an agent inherits trust from its owner, the same way a company employee acts under the company's authority rather than needing to independently prove their own credibility to every vendor they contact. If the human is real and in good standing, the agent they delegate to should be able to prove that — without the agent itself needing to pass a behavioral Turing test, and without exposing who that human actually is.

How It Works

The flow has four steps, and none of them require the agent to store or transmit anything about the human beyond a signed, expiring, revocable token:

• A human completes gesture verification at homosapience.org/verify — the usual anonymous, zero-PII flow, producing a DID anchored on Aptos.
• The verified human requests a delegation token for their agent (agent_id, a permission scope like ["read","search"], and an expiry) via POST /api/agent/delegate.
• The agent presents that token to any third-party service, which checks it via a public, unauthenticated GET /api/agent/verify — no API key, no enterprise contract.
• The human can revoke the delegation at any time; every subsequent verify call for that token immediately returns invalid.

curl "https://homosapience.org/api/agent/verify?token=<token>"
→ {
  "valid": true,
  "human_trust_score": 0.95,
  "human_trust_label": "community_verified",
  "agent_id": "my-shopping-assistant",
  "permissions": ["read", "search"],
  "expires_at": "2026-07-24T10:00:00+00:00"
}

Notice what's missing from that response: the human's DID. A relying party learns that a real, verified human — with a specific trust level — stands behind this agent, and exactly what it's permitted to do. It never learns which human. Privacy and accountability aren't in tension here; the credential is designed so you get both at once.

Verified at runtime, not just once

This isn't a one-time stamp checked at signup and forgotten. Every single /api/agent/verify call re-checks expiry and revocation against the server, live. If an agent is compromised or simply no longer trusted, the human owner revokes the delegation once, and every subsequent call — from every site the agent touches — fails immediately. There's no need to rotate the underlying DID, and no window where a revoked agent keeps working somewhere because a check was cached.

Why Behavioral Detection Alone Falls Short

Behavioral bot-management is a real, useful layer — and we're not arguing it should disappear. But it has a structural ceiling: it can flag an agent as suspicious, and it can score confidence that a session is automated, but it fundamentally cannot answer 'who owns this, and what happens if I'm wrong to trust it?' A perfectly-behaving malicious agent looks identical to a well-behaved legitimate one under pure behavioral analysis. Human accountability is a different axis entirely, and it composes with behavioral analysis rather than replacing it.

This Isn't a Niche Problem Anymore

Industry signals point the same direction we do. The inaugural Non-Human Identity (NHI) Pavilion at Identiverse 2025 dedicated sessions specifically to "When AI Agents Inherit Risk" and "Securing AI Agents in RunTime," framing agent identity as, in the organizers' words, one of the biggest challenges the security industry is currently facing. Separately, at least one major bot-management vendor has already shipped a dedicated "AI Agent Trust" product line, treating agent identity as important enough to warrant its own product, not a footnote feature bolted onto existing bot defense.

Try It

HDAA is live today, free, and open — no waitlist. If you're building or operating an AI agent and want a way for the sites it touches to trust it without a $100K enterprise bot-management contract, the full walkthrough, token format, and API reference are on the Agent Passport page.