Hardware-Backed Oversight for AI Agents: Introducing txAuthAgent

On August 2, 2026 the high-risk provisions of the EU AI Act became enforceable. Two articles change the game for anyone running autonomous agents in production:

• Article 14 requires human oversight of high-risk AI systems.
• Article 12 requires tamper-evident logging of those systems' operations.

If you run AI agents that act on behalf of humans, these are no longer aspirational governance goals. They are legal requirements. And they collide directly with a hard technical reality: software-only authorization is forgeable, and logs are mutable. "The agent said it was authorized" is not evidence a regulator will accept.

We are proposing txAuthAgent, a new WebAuthn extension that closes the gap: hardware-backed authorization for AI agent actions, signed by the human's security key at the moment of execution.

The problem

Autonomous agents execute actions on behalf of a human: placing orders, deploying code, sending messages, moving funds. Today, that authorization lives in software. An API key, a session token, a policy file. All of them share the same weakness: whoever controls the process controls the authorization.

When an auditor or regulator asks "was this action actually authorized by a human?", a software log line cannot answer. It can be edited, replayed, or fabricated by the same agent that performed the action.

The fix is to move the authorization boundary into hardware, the same way WebAuthn moved authentication into hardware a decade ago.

The WebAuthn gap

The IANA WebAuthn extension registry contains 15 registered extensions. They break down into clear categories:

• Human authentication: appid, uvm, uvi, authnSel
• Human transaction authorization: txAuthSimple, txAuthGeneric, payment/SPC
• Credential management: credProtect, credBlob, largeBlob, minPinLength
• Device properties: credProps, loc, exts

That is 15 extensions covering authentication, transaction confirmation, credential management, and device properties. Zero of them address agent action authorization - the case where an autonomous AI agent performs actions on behalf of a human and those actions must be cryptographically attested by hardware.

The registry has a proven pattern for transaction authorization: txAuthSimple and txAuthGeneric let a human confirm a transaction on their security key. We are extending that pattern from human transaction confirmation to agent autonomy.

The idea: txAuthAgent

txAuthAgent is a proposed WebAuthn extension that works like this:

1. An AI agent constructs an action payload (JSON: action_id, action_type, action_descriptor, timestamped nonce).
2. The agent invokes navigator.credentials.get() with the txAuthAgent extension input, carrying the action payload and the agent's identity (ACI URI).
3. The authenticator (CTAP 2.2+; e.g. YubiKey 5 Series, Ledger FIDO2 app, Nitrokey 3) presents the action to the human and requires a physical gesture (press/tap) before signing.
4. The authenticator returns a CBOR extension output containing an EdDSA/ES256 signature over the action digest plus UP/UV flags - a hardware-attested, human-consented agent authorization.
5. Any relying party can verify the signature against the registered credential without contacting the agent - no secret validation server required.

The UP flag proves a physical human gesture. The UV flag proves biometric or PIN verification. Both are asserted by the authenticator hardware, not by the agent's software stack.

How it works

The reference implementation is a small Python package that follows the extension wire format from the draft spec. The core flow is:

# Agent side: build the action payload and request authorization
payload = ActionPayload(
    action_id="order-8821",
    action_type="purchase.execute",
    action_descriptor="Place order for 100 units at $49.95 each",
    nonce=secrets.token_bytes(32),
)
input = txAuthAgentInput(aci_uri="aci://empirelabs/order-agent", payload=payload)

# Authenticator returns the signed extension output
output = await authenticator.sign(input, require_gesture=True)

# Relying party side: verify without contacting the agent
assert verify(output, credential_public_key, expected_digest)

The digest is canonical: SHA-256("txAuthAgent" || 0x00 || canonical-JSON(payload)). Both sides compute it from the same payload, and the signature binds it to the hardware credential.

The full repo includes:

• The complete draft specification (spec v0.2)
• A Python reference implementation (txauthagent package)
• CBOR encode/decode for the extension wire format
• A virtual authenticator for testing (Ed25519 and ES256)
• A CLI demo showing the full flow, including tamper detection

Why it is verifiable by anyone

The critical property: no secret validation server is required. The signature checks against the registered credential and the ACI identity declaration. Any party - the agent operator, the counterparty, the auditor, the regulator - can verify the authorization independently.

This is what makes it different from "the agent logged that it asked permission". The evidence is cryptographic, anchored in hardware the human physically controls, and independently checkable by third parties.

EU AI Act mapping

Provision	Requirement	txAuthAgent
Art. 12	Tamper-evident logging	Signature over action digest is cryptographically bound to hardware; logs cannot be silently edited
Art. 14	Human oversight	Physical gesture + optional PIN/biometric at the moment of action signing
Art. 15	Cybersecurity	Private key never leaves the authenticator; no software secret to steal

Hardware available today

The extension targets CTAP 2.2+ authenticators that are already shipping:

• YubiKey 5 Series (CTAP 2.3)
• Ledger FIDO2 app
• Nitrokey 3

No new hardware is required to start building against the pattern.

Call to action

txAuthAgent is an open draft specification, MIT licensed, built by Empire Labs Pty Ltd as part of the Empire Stack (ACI / AIP / AJSON). We have submitted it to the W3C public-webauthn mailing list for expert review and are requesting registration of the identifier.

• Full draft spec and reference implementation: github.com/narko4u/webauthn-agent-action-extension
• 75 passing tests, CLI demo, virtual authenticator
• Expert review requested from Tim Cappalli, Akshay Kumar, and Emil Lundberg

If you run agents in production and want oversight that survives an audit, star the repo, open an issue, and join the conversation. Hardware-backed oversight for agents is not optional anymore. It is enforceable.

---

Security Division, Empire Labs
www.empirelabs.com.au