Introduction

People are starting to let AI agents act for them. Signet tells a business that a real, unique person stands behind an agent, and nothing else about them.

The problem

Businesses limit what is scarce or free to one per person: a free trial, a sign-up bonus, a limited drop, a table on a busy night. Accounts, email addresses and API keys cost nothing to create, so one person, or one bot, can claim the same allowance many times.

AI agents make this harder. Anyone can run many agents, and to a business's servers a customer's agent, a scraper and a malicious bot all arrive as automated traffic. The tools businesses use today each fail in one direction:

  • Bot defenses stop automation, so they also turn away the agents real customers send.
  • Identity checks (KYC) stop duplicate accounts, but they give the business the person's real identity, and let businesses link the same person across sites.

A business needs to know that one real person stands behind a request, and to recognize that person when they return. It does not need to know who they are.

The three ideas

One person, counted once

A person verifies their identity once with Signet, on their own device. The device checks the identity document and proves to Signet's registry that the document is genuine, with a zero-knowledge proof: a proof that a statement is true which shows none of the data behind it.

The registry accepts each document only once, so the same document cannot enroll twice. It stores no name, no document number and no photo. Witnesses, run by independent parties or by businesses, check every change to the registry, including the proof behind each new entry, and co-sign it only if it follows the rules. So the registry cannot add people who never enrolled, and everyone sees the same registry.

A different private identifier at every business

When an agent first needs Signet at a business, the person's device proves to that business that the person is in the registry, without showing which entry is theirs, and gives the business a private identifier for them. It stays the same at that business, so the business can count per person, and differs at every other business, so businesses cannot link the person. Privacy and data explains how.

Limited permission for each agent

The person never hands their identity to an agent. Their device signs a permission for the agent's own key, stating which actions the agent may take, how many times and until when. The agent signs every request it sends, and the business checks the signature and the permission on its own server before the action runs. If an agent is compromised, the damage stays within its permission.

For sensitive actions, a business can also require the person to approve the exact action on their device.

A request, from start to finish

  1. An AI agent asks a business for an action its rules protect, such as starting a free trial.
  2. The agent has no proof yet, so the business answers VERIFY FIRST, and the agent asks its person to verify.
  3. The person's device proves to the business that the person is in the registry, and the business receives their private identifier.
  4. The device gives the agent a limited permission.
  5. The agent signs the request and sends it with its permission. The business checks both, applies its own rule to the private identifier, such as one free trial per person, and answers ALLOW or DENY.

The proof in step 3 runs once per session, not on every request. Later requests need only quick signature checks.

What Signet is not

  • Not a bot blocker. Signet does not judge whether an agent is good or bad. It tells a business whether a verified person stands behind the agent, and the business decides what that allows.
  • Not KYC. The business never learns the person's name or any detail of their identity document.
  • Not in the middle of the traffic. Agents send their requests straight to the business, and Signet's SDK checks them on the business's own server. Signet never sees the business's traffic.