Human trust layer for the agent economy
Verify the human behind an AI agent
Pause an agent before a sensitive action and require a live BioTone attestation from the human principal — bound to the exact action, not the account.
- Five illustrative scenarios: travel booking, wire signing, CEO voice-call defense, content provenance, agent-to-agent contracts.
- Short-lived signed JWT carries the action context, scope, and required assurance back to the agent.
- Enterprise-tier BioTone deployment plus a thin API integration in your agent's tool layer.
Demo: Agent action attestation demo
Read the verify the human behind an ai agent pattern →
$2.4M wire
step-up required
Step-up signing
High-value transaction & wire approval
Bind a biometric attestation to the exact wire — amount, beneficiary, time window — so your treasury system can require fresh verification before release.
- Treasury console pauses on first-time beneficiary, above-threshold, or out-of-hours wires.
- Approver completes multi-signal verification on their own phone, bound to the wire payload.
- Record the verification outcome, approved action, and signed result under your audit and data-retention policy.
Demo: Apex Treasury wire-transfer demo
Read the high-value transaction & wire approval pattern →
Sign-in with BioTone
Workforce SSO and step-up for Entra, Okta, and Ping
Add a biometric verification step to your existing identity provider — for first sign-in, MFA enrollment, and high-risk step-ups — without replacing the IdP.
- Broker pattern: web app → QR / deep link → mobile capture → asserted session.
- Entra, Okta, and Ping reference flows; validate tenant configuration and policy before rollout.
- Operates alongside your existing passkey, hardware-key, and TOTP options.
Demo: Auth-broker demo (generic, Entra, Okta, Ping)
Read the workforce sso and step-up for entra, okta, and ping pattern →
Anti-impersonation
Caller verification for contact centers
Add verification on an enrolled device before releasing sensitive account actions, rather than relying on the support call alone.
- QR or deep-link handoff to the caller's enrolled handset, separate from the support call.
- Required per high-value account action (transfer, beneficiary change, password reset) under your policy.
- Returns a signed proof the agent's CRM can attach to the case file.
Demo: Anti-impersonation scenario in the agent demo
Read the caller verification for contact centers pattern →
Allowlisted access
Document, file, and read-room unlock
Release a board pack, M&A data room, or sensitive file only after an allowlisted recipient completes a live BioTone verification — not just a link click.
- Per-document allowlist of subjects (subject IDs map to your IdP user records).
- File unlocks only after broker session completes; audit captures who and when.
- Designed to compose with key-disaggregation deployments where no single party holds the unlock key.
Demo: Console allowlist + auth-broker pattern
Read the document, file, and read-room unlock pattern →
Experimental session assurance
Continuous re-authentication
Explore periodic verification and policy-triggered step-up. Background collection, signal availability, and enforcement require pilot validation.
- Research directions include presence signals, brief deliberate checks, and full multi-signal verification.
- A pilot can test when a session needs fresh verification before a sensitive action.
- Maps onto NIST SP 800-207 patterns — re-evaluation per resource, not just per sign-in.
Demo: Continuous session assurance panel in the agent demo
Read the continuous re-authentication pattern →
