As artificial intelligence (AI) agents gain the ability to act on users’ behalf, iProov wants to make sure humans still have the final say when it matters.

The biometric identity verification company has published the Human Approval and Presence Specification (HAPS), an experimental framework designed to verify that a human approved a specific action before an AI agent is allowed to execute it.

Published on GitHub under an Apache-2.0 license, HAPS includes procedural rules, a partial Rust reference implementation and test materials. iProov is inviting developers and security experts to scrutinize the approach and build their own implementations.

The framework targets a growing problem in agentic AI: having permission to access a system does not necessarily mean an agent’s individual action was intended or approved by its human user.

“AI agents are moving rapidly from answering questions to taking actions on our behalf. As their autonomy and capabilities grow, governance must keep pace,” iProov founder and CEO Andrew Bud said.

“We need to distinguish between an agent having permission to act and a human actually approving the specific action it is about to take,” he added.

HAPS is not designed to interrupt every AI action. Organizations instead determine which sensitive or high-risk activities require human confirmation.

When approval is required, the agent’s proposed action is paused and presented to the user. Evidence of human presence and approval is then linked to that particular request before it can proceed.

The specification does not mandate a particular method for proving human presence. iProov said biometric liveness technology is one possible implementation, but HAPS is designed to accommodate other approaches.