Step 1
Agent reads /.well-known/biotone-agent-protection.json to discover endpoints, supported scopes, and execution modes.
Design-partner evaluation
Let the person approve the action
Show the enrolled person what the agent is requesting, verify their participation, and limit the authorization to the approved scope and time window.
- Agent-readable discovery through a well-known BioTone protection document.
- QR or mobile-deep-link verification before the delegated claim is issued.
- Tenant-configured claim profiles for scopes, audiences, TTLs, and allowed execution modes.
- Controlled execution for PII-vault benchmarks so agents can trigger work without receiving raw decrypted data.
How an agent gets a protected claim
The flow is intentionally similar to device-code login: the agent can start the authorization, but a verified human must complete BioTone approval before the token is useful.
Step 2
Agent creates a claim session for a tenant claim profile, such as internal-pii-benchmark or production-deploy-approval.
Step 3
BioTone presents the human with the action, scope, execution mode, expiry, and data-boundary warning through QR/mobile verification.
Step 4
On approval, the agent receives a short-lived delegation JWT whose audience, scopes, TTL, and execution mode are tenant-policy constrained.
Tenant-controlled execution modes
BioTone does not assume every agent should receive data. Each tenant chooses which modes are enabled for each claim profile, and whether plaintext can ever leave controlled compute.
Controlled execution
An evaluation job runs in a controlled environment. The requesting agent receives job authority rather than the raw decrypted capture files.
Backend-mediated action
The agent asks BioTone to perform a specific approved action, such as queueing a benchmark or creating an audit-bound report.
External stream
A tenant-enabled option for cases where samples must stream to an external agent environment. It carries explicit plaintext-export warnings.
External bundle
A tenant-enabled option for reproducible external runs. The tenant policy decides whether this is available and how short the lease must be.
Console-managed policy, audited by tenant
The first console implementation configures permitted actions, expiry, human approval, and data-access rules for internal evaluation jobs. Customer workflows require integration and acceptance testing.
The same pattern can be evaluated for deployment approval, data exports, financial approvals, and publication workflows.
Discuss agent protection
Best fit for AI app builders, agent platforms, regulated data teams, fintech, and security teams designing high-risk tool use.