The Pulse
iProov Publishes HAPS Specification for Human Approval of AI Agents
iProov has published HAPS, an experimental open specification for verifying that a human approved a specific action before an AI agent executes it. The Apache-2.0 project includes a partial Rust implementation, schemas, formal models and te
AI.info Team ·
iProov has published an experimental open specification aimed at separating an AI agent’s permission to act from proof that a human approved the specific action. The Human Approval and Presence Specification, or HAPS, is available under the Apache-2.0 license and is designed for organizations that need to pause high-risk agent actions until they can verify human approval.
The release creates a tension familiar to anyone deploying autonomous systems: agents are expected to act without constant intervention, but organizations still need evidence that a person authorized consequential decisions. iProov’s answer is not to place a human in front of every routine task. Instead, HAPS defines a procedure for escalating selected actions, displaying the proposed action to a human, collecting evidence of presence and approval, and binding that evidence to the exact action before execution.
“We need to distinguish between an agent having permission to act and a human actually approving the specific action it is about to take,” Andrew Bud, founder and CEO of iProov, said in the company’s announcement. “HAPS is a specification that makes that human approval verifiable.”
HAPS targets the gap between permission and intent
iProov says the problem is not limited to agents that break out of their assigned permissions. An agent may have valid credentials and remain within its formal authority while still taking an unintended action because of prompt injection, excessive goal-seeking or the misuse of delegated credentials. In those cases, the receiving system can see that the request is technically authorized, but may lack evidence that a human intended the specific transaction.
HAPS treats human approval as evidence that must be connected to a machine-readable action. The project’s public repository describes a signed Consent Credential containing, among other fields, an intent_hash for the canonical action and a presentation_hash for the view that the provider says it displayed to the approver. It also includes audience, challenge, expiration and single-use identifiers intended to limit replay and misdirected approvals.
The specification does not replace OAuth, OpenID Connect, WebAuthn or biometric systems, and it does not grant an agent standing authority. Those permissions belong to a separate mandate or capability layer. HAPS instead focuses on whether a relying party can assess evidence of fresh approval for a particular action.
The open project is deliberately unfinished
iProov describes HAPS as an “experimental draft specification” and says it is not production-ready. The GitHub repository contains the draft protocol, schemas, formal models and test vectors, while a separate repository holds the partial reference implementation.
The project currently covers canonicalization, hashing and a test adapter, according to its repository documentation. The implementation does not provide a complete verifier or credential-signature verification, and the project warns that passing the supplied tests does not prove that a person saw or approved the correct action. Those limitations place the release closer to an invitation for technical review than a finished compliance product.
iProov is asking outside developers to challenge the design, file issues and create independent implementations. The repository says conformance should be judged against the specification and test vectors rather than against iProov’s own code. The project is licensed under Apache 2.0, although that license does not grant rights to iProov’s proprietary liveness technology, models or services.
Approval depends on the risk of the action
HAPS does not require approval for every operation an agent performs. iProov says organizations should decide which actions are sensitive or consequential enough to require additional evidence, since approving every step could create approval fatigue and erase the efficiency gained from automation.
The specification is also factor-agnostic. Its repository lists physically actuated hardware, smart cards, human-held signing keys, biometric passkeys, WebAuthn and liveness as possible sources of a fresh human signal. Lower-risk workflows may use factors such as one-time passwords or push approvals, but the repository distinguishes those from methods intended to resist an agent that can access a user’s device, session or credentials.
That distinction matters because a familiar approval prompt can show that a credential was used without proving who made the decision or what they approved. HAPS attempts to make the action itself part of the approval record, while leaving the organization to decide what evidence meets its threat model.
Bud will present the design in Amsterdam
Bud is scheduled to present HAPS’s design requirements at AGNTCon + MCPCon Europe in Amsterdam, which runs from September 17 to September 18, 2026. The conference’s program focuses on agent infrastructure, Model Context Protocol systems, security and enterprise governance.
For now, HAPS offers a public protocol draft rather than an industry standard. Its immediate test is whether independent implementers can interpret the requirements consistently—and whether relying parties can use the resulting evidence to show not merely that an agent was allowed to act, but that a human approved the action it actually took.
Read iProov’s announcement and review the HAPS repository on GitHub.