Two launches on the same day. Same idea underneath. The control point for AI agents is moving from “what does the agent know” to “what did a human say yes to.”
Launch one: 1Password for Agents. When a personal AI agent hits a login page, it proves its identity to 1Password with its own digital key. You get a prompt showing which credential it wants and why. You approve on your own device. Then 1Password types the password straight into the sign-in form. The agent never sees it (1Password via Business Wire). Engadget reports access is granted per session, limited to approved items, and not carried over. Launch partners include Meta’s Muse, Anthropic’s Claude Duet, OpenAI’s ChatGPT Work and Dots, Grok Bot and Town’s Townie. It’s free for Individual and Family accounts on 1Password.com.
Launch two: iProov’s human approval service. This one is built for enterprise agent gateways, the checkpoints that sit between agents and the systems they act on. When a policy says an action needs a human, the action is held. The named approver sees the exact action and its scope, then passes an iProov check that a real person is present. iProov issues a signed, single-use credential tied to that action. Change any detail, like the amount or destination of a payment, and the credential stops matching. The action is blocked (iProov). First integrations: solo.io’s agentgateway and Cerbos. It implements HAPS, the Human Approval and Presence Specification, which iProov published as open source.
The one point that matters. These are two different kinds of yes.
1Password’s yes is a yes to a session: this agent can sign in here, now. That kills the worst problem, agents holding your passwords. But once the agent is in, it can still click the wrong thing. Engadget put it plainly: agents won’t spill your password, but they can still book the wrong vacation.
iProov’s yes is a yes to an action: this payment, this amount, this destination. That’s the control an auditor wants for anything you can’t undo. It’s also much heavier. You won’t do a face check to let an agent read your calendar.
Enterprises need both layers. Keep secrets out of the agent’s reach. Then require action-bound approval for the short list of moves that move money, delete data or change access. Everything else runs on policy without a human.
The trap: approval fatigue. We’ve seen this movie. Push-notification MFA got beaten by attackers who simply spammed prompts until a tired user tapped “approve.” Agents can generate prompts faster than any attacker. iProov’s own technical paper makes the same point: making every agent action a human approval would create approval fatigue and turn human control into a ceremony. HAPS draws a line between “agent-resistant” factors, which need a real human act even if software controls the device, and “agent-accessible” ones like a one-time code or push tap, which software could satisfy (HAPS spec).
That distinction is the most useful idea in either launch. If your agent runs on your laptop, and your approval is a tap on that same laptop, how sure are you the human tapped it?
Read the fine print. HAPS’s own GitHub page calls it an experimental draft with a partial reference implementation, “not production-ready.” 1Password for Agents is a consumer product today, and accounts on 1Password.eu and 1Password.ca aren’t supported yet. Neither is a drop-in enterprise control this quarter.
What we’d do this week. List the agent actions you’d never want to happen without a person: payments, deletions, permission changes, external sharing. For each, ask your agent platform vendor one question. Is the approval bound to the exact action, or just to the session? If they can’t answer, that’s your gap.