Locking an errand to your touch
Services that want proof you approved an AI agent's action should never receive your raw fingerprint or face scan. A password can be changed after a leak, but a fingerprint can't. We propose on-device schemes that combine the biometric reading with the specific task and send out only a proof that can't be turned back into the biometric.
As AI agents buy tickets and sign agreements on people's behalf, services want proof that a real person approved the action. A common proposal is to upload a face scan, iris image or fingerprint to a central database and match against it. That turns the database into a target: once it leaks, those credentials are compromised for life, because you can't issue a replacement thumb.
The honey pot on the server
Uploading raw biometric scans creates an irreversible hazard. Passwords and digital keys can be rotated when a server leaks. If an attacker steals your API key, you revoke it and create another in thirty seconds. But you cannot revoke your thumb. You cannot issue a replacement retina after a company database spills onto the dark web.
Centralized biometric registries turn ordinary platforms into high-value honey pots. Once an attacker breaches the central database, they obtain permanent credentials for thousands of individuals. Worse still, ambient bearer credentials allow rogue software to replay past approvals without fresh human consent.
What this means
You can change a compromised password in seconds. You cannot change your fingerprint or your face after a remote server leaks them.
Locking the key inside the sensor
In recent security research, investigators demonstrated a cleaner path for autonomous systems.1 Rather than transmitting biometric data to distant servers, the entire verification happens on the user's personal hardware.
The system uses biometric cryptosystems, specifically fuzzy commitment schemes.2 When you press your thumb against your phone or laptop, the physical sensor never outputs your raw biometric template. Instead, it measures subtle ridge patterns with slight natural noise.
The local operating system combines that physical reading with a random cryptographic secret and an error-correcting code. It produces helper data that binds the secret to your biometric imprint. This helper data is mathematically non-invertible: an adversary looking at the helper data cannot reconstruct your fingerprint.
When you want your assistant to execute a specific task, your physical touch releases that local key. The key signs a narrow, short-lived delegation voucher for the assistant. The assistant carries that voucher to the remote merchant or service. The merchant verifies the signature using public cryptography, without ever seeing or storing your biometric features.1
Three safeguards for touch-bound agents
Binding an assistant to physical presence requires three firm engineering safeguards.
First, keep the biometric template inside the secure enclave. Raw sensor readings must never cross process boundaries, let alone travel across networks. The hardware enclave uses the biometric match only to unlock a localized signing credential.1
Second, bind every proof to a single task envelope. When you touch the sensor to authorize a purchase, that signature must name the exact merchant, maximum spend limit, and expiration deadline. If an attacker intercepts the signature, they cannot reuse it for a different transaction or a broader scope.3
Third, respect non-biometric community paths. Biometrics are not appropriate for every human or every civic group. When community platforms need to separate real residents from automated bot swarms, they should rely on peer trust networks and mutual vouches rather than demanding iris scans.4 Physical biometric binding belongs on personal hardware where you control the sensor.
Honest limits
Biometric cryptosystems solve the custody dilemma. They let you prove human intent without handing over your biological markers. But physical security still has limits.
A secure sensor cannot tell whether you were tricked into tapping your screen. If an assistant summarizes an agreement misleadingly, a user might touch the sensor without understanding the hidden commitments. Cryptography ensures non-repudiation, but clear interfaces and human comprehension remain irreplaceable.
Hardware sensors also experience natural wear and environmental variability. A sweaty finger or a scratched camera lens introduces noise that error-correcting codes must tolerate without lowering security thresholds. Modern fuzzy commitment designs manage this balance effectively, but fallback recovery methods must remain private and accessible.
By locking authority to local touch rather than central servers, we keep human sovereignty at the center of autonomous software. You can inspect verified implementation patterns and civic safeguard cards in our Shared Horizon action library.
- J. G. Benjamin, A. K. Jain, and K. Nandakumar, “Binding Biometrics with AI Agent Identifiers for Delegation of Authority,” arXiv preprint arXiv:2608.04292 (August 2026).
- A. Juels and M. Wattenberg, “A fuzzy commitment scheme,” in Proceedings of the 6th ACM Conference on Computer and Communications Security (1999), 28–36.
- J. B. Dennis and E. C. Van Horn, “Programming semantics for multiprogrammed computations,” Communications of the ACM 9, no. 3 (1966): 143–155.
- Ramji et al., “Anduin: A sybil-resistant agentic marketplace reputation system,” arXiv preprint arXiv:2611.05586 (November 2026).
