Today, if your organization’s AI agent makes a payment, changes a user’s identity credentials, or executes a trade, most enterprise identity infrastructure has no mechanism to stop it — unless a human manually intervenes before the session begins. Daon’s third and final agentic AI governance patent, awarded this week, is designed to change that: it authorizes or denies each sensitive agent action individually, at the exact moment the agent attempts it, rather than relying on broad permissions set at login.
The Fairfax, Virginia-based identity and biometrics company announced the patent this morning, completing what it describes as a three-part commercially patented trust stack for controlling autonomous AI agents. The timing is pointed. A Cloud Security Alliance survey commissioned by Aembit in January 2026 found that nearly three-quarters of organizations give AI agents more access than their tasks actually require. A separate April 2026 report from Gravitee, an AI agent management platform, found that enterprise AI agent fleets roughly doubled since December 2025 while mean monitoring coverage barely moved — leaving close to half of all deployed agents operating without security oversight or logging.
Why One-Time Authentication Fails for AI Agents
Traditional enterprise software assumes that security happens at login. A user authenticates, establishes a session, and then operates within whatever permissions were granted at that moment. For humans working through a single sequential task, that model is serviceable. For AI agents, it is a structural mismatch.
Unlike a human employee who authenticates once and works step by step, an autonomous agent can plan, branch, run parallel sub-tasks, and call external tools at machine speed — often without any human approving each individual step. The permissions granted at login were designed for the session that follows, not for the hundreds of tool calls and API requests an agent might generate during execution. When an agent’s permissions are set at the session level, even a narrow task delegation effectively hands the agent admin-scale access for the session’s entire duration.
“Traditional identity and access management was designed around a human authenticating and then operating within a session,” said Ralph A. Rodriguez, President and Chief Product Officer at Daon. “Autonomous agents can plan, branch, parallelize, and invoke tools at machine speed. This requires the control question to become more precise: should this agent be allowed to perform this exact action, against this exact resource, right now?”
The result of not asking that question is what Orchid Security, a commercial identity governance vendor, has called “identity dark matter”: a growing invisible layer of agents operating with human-scale credentials in spaces that identity infrastructure was never designed to observe. Gartner’s February 2026 top cybersecurity trends research identified agentic AI governance and IAM adaptation as two of its six defining trends for the year.
How Daon’s Three-Patent Trust Stack Works
The architecture Daon has built consists of three interlocking layers, each addressed by a separate patent.
The first patent handles principal fidelity — whether the agent is still faithfully acting for the human principal who authorized it. This is not a trivial check. AI agents can be manipulated through prompt injection attacks, where malicious instructions are embedded in content the agent reads — a webpage, an email, an API response — causing it to follow those instructions as if they came from a legitimate operator. Prompt injection ranked first on the OWASP GenAI Security Project’s Top 10 for 2026; an agent that passes initial authentication can still be redirected mid-task by an external attacker. The first patent continuously monitors whether the agent-to-principal relationship remains intact.
The second patent addresses behavioral integrity — whether the agent and its runtime environment continue to operate within expected parameters. An agent that began a session with legitimate intent can drift or be coerced into behavior outside its sanctioned boundaries as execution proceeds. This layer monitors the agent’s behavior and its runtime environment as a check on whether the agent is still doing what it was authorized to do.
The third patent — announced today — shifts the final enforcement point to the moment of action itself. Rather than relying on either of the prior two checks having been passed at some earlier point in the session, this layer evaluates whether the specific action being attempted right now should be permitted. Every authorized action becomes what Daon calls a “digital permission slip”: cryptographically constrained by action type, resource scope, and a tightly defined time window. Each permission also carries rate and transaction limits, execution-context binding — meaning the token is invalid if the runtime environment changes — and session-tied replay protection, which prevents a previously granted permission from being reused by a hijacked or modified agent.
The three layers together answer three connected questions for any AI agent attempting a sensitive action: is this still the agent that the right person authorized? Is it still behaving as expected? And should this specific action be permitted against this specific resource, right now?
“Agentic AI is unlikely to safely move from experimentation into high-value production environments on intelligence alone,” said Tom Grissen, CEO of Daon. “It requires identity, policy, containment, and evidence at the moment an agent attempts to act.”
What the Architecture Does at the Execution-Context Level
The session-tied replay protection and execution-context binding in Daon’s third patent deserve specific attention, because they represent the technical departure point from standard enterprise authorization approaches.
In most OAuth 2.0 deployments — the dominant enterprise identity standard — access tokens are issued to authorize a session or a scope of access, not a specific action. Once issued, a token is valid until it expires or is revoked, regardless of what the agent does in between. An agent that has been granted a token for “read customer records and draft a response” can, depending on how scopes are configured, make many more requests than the task requires without triggering any additional authorization decision.
Daon’s per-action token model is architecturally closer to the “capability-based security” principle formalized by security researchers Saltzer and Schroeder in 1975, and recently revisited by academic researchers building authorization frameworks specifically for agentic AI. The core idea: access rights should be tied to a specific action against a specific resource, not to a session or a role. The commercial patent places Daon ahead of both academic proposals and nascent open standards efforts in terms of IP protection, even as NIST’s National Cybersecurity Center of Excellence continues developing open guidance in the same space.
The practical implementation works as follows: when an agent attempts a sensitive action — a payment, a credential change, an irreversible API call — it requests a per-action token rather than simply exercising a pre-granted session permission. The authorization system evaluates the principal-fidelity and behavioral-integrity checks in real time before issuing the token. The token itself is cryptographically bound to the execution context in which the agent is running, meaning it is valid only in that specific runtime environment. If the agent’s state has been modified by a prompt injection attack or a tool-call interception, the execution context no longer matches the bound token, and the action is denied.
Who Gets the Most Direct Protection
Daon has designed the three-patent architecture for industries that face both the highest agentic AI adoption pressure and the highest regulatory scrutiny: financial services, insurance, healthcare, telecommunications, and the public sector. These sectors handle sensitive records, large financial transactions, and personally identifiable information that regulators scrutinize closely.
The practical use case in regulated environments is a tiered permission model. An agent might proceed with lower-risk read operations — retrieving account data, drafting a transaction for human review, assembling a compliance report — under broader standing permissions. But irreversible or high-stakes actions — executing a payment, changing identity credentials, releasing sensitive personal data, completing a securities trade — would require a fresh per-action authorization at the moment of attempt, with a narrow scope, a short validity window, and rate limits that prevent bulk execution without human review.
The regulatory context makes this architecture increasingly relevant. The EU AI Act’s compliance deadline for high-risk AI systems — which includes many financial and healthcare AI applications — arrives August 2, four days from now, placing particular emphasis on human oversight mechanisms. The NIST AI Agent Standards Initiative, announced in February 2026, identified agent governance and authorization as a priority area for standards development. A discussion draft of the Artificial Intelligence Access, Gatekeeper Exchange, and Nondiscriminatory Transfer Act released by Senator Mark Warner on June 29, 2026, would require NIST to develop open technical standards specifically for agent authentication — a parallel effort in the same problem space.
How This Fits Into a Crowded Governance Landscape
Daon is not the only organization working on agent authorization. SecureAuth markets per-action authorization for AI agents using OAuth 2.1 and the Model Context Protocol; Microsoft’s Entra Agent ID platform addresses machine identity for agentic systems; and Yubico has integrated hardware-backed role delegation tokens with Delinea’s authorization infrastructure specifically for AI agent governance. The NIST NCCoE’s concept paper on software and AI agent identity, published in February 2026, drew responses from across the industry.
What distinguishes Daon’s position is the commercial patent across a complete three-layer architecture, developed through its Daon Labs research division. Daon’s broader portfolio spans more than 320 patents across biometric authentication, deepfake defense, and digital identity — and the identity assurance expertise is directly relevant here, since the first layer of the trust stack (principal fidelity) relies on continuous binding to a verified human identity, not simply to a credential.
Gartner has predicted that 40% of enterprise applications will include task-specific AI agents by the end of 2026, up from under 5% just two years ago. At that scale, the gap between session-level permissions and per-action control stops being an architectural refinement and becomes a systemic liability. Darktrace’s 2026 State of AI Cybersecurity report, released in February, found that 76% of security professionals are now specifically worried about the security implications of integrating AI agents into their organizations — and that only 37% of organizations have a formal AI policy in place, a figure that actually declined from the prior year.
“Our research creates a practical trust stack for safe agentic AI: maintain fidelity to the person, assess integrity of the agent and its runtime, and authorize or constrain each sensitive action,” Rodriguez said.
Whether enterprises adopt Daon’s specific architecture or converge on open standards built around the same principles, the trajectory is clear: deploying an AI agent with a standing session login and relying on a human to catch problems after the fact is no longer a defensible governance posture for organizations that handle sensitive data or irreversible transactions. The question is no longer whether per-action authorization is necessary — industry research, regulatory deadlines, and documented incidents have settled that — but which architecture implements it, and who holds the IP.
Frequently Asked QuestionsWhy can’t traditional enterprise identity systems control what AI agents do?
Standard identity and access management (IAM) was built for human users who authenticate once and then act sequentially. The session-level permissions it grants work adequately when the same human is behind every action. AI agents operate differently: they branch into parallel sub-tasks, invoke external tools dynamically, and can be manipulated mid-session through prompt injection attacks — where malicious instructions are embedded in content the agent reads. Once an agent’s instructions have been hijacked, session-level credentials mean the agent still appears authorized while acting for an attacker. Per-action authorization closes this gap by evaluating whether the specific action should be permitted at the exact moment the agent attempts it, independently of whatever happened earlier in the session.
What specifically happens when an AI agent’s execution context is compromised?
An agent’s execution context is the sum of its runtime state: its code, its memory, its tool connections, and the environment it is running in. If a prompt injection attack redirects the agent, or if a tool-call interception modifies what the agent believes its instructions are, the runtime state changes. Daon’s session-tied execution-context binding cryptographically ties each per-action token to the specific runtime environment at the moment the authorization was granted. If that environment has changed — because the agent has been tampered with — the token becomes invalid, and the action is denied. This is the technical mechanism that distinguishes per-action authorization from simply using shorter-lived OAuth tokens.
Does Daon’s patent cover the same ground as NIST’s open standards work, and what does that mean for organizations building their own frameworks?
The NIST NCCoE’s concept paper on software and AI agent identity and authorization, published in February 2026, covers overlapping conceptual territory — specifically, the need to move from session-level to action-level authorization for AI agents. Daon’s commercial patent portfolio and NIST’s open standards effort can coexist, but enterprises and vendors building their own per-action authorization frameworks should understand the IP landscape Daon’s patents create. Organizations implementing NIST-aligned open approaches may face questions about whether their architectures overlap with Daon’s commercial IP. This is an evolving area; the NIST AI Agent Standards Initiative’s standards development process is ongoing, and the picture will clarify as that work progresses.
Which types of AI agent actions should require per-action authorization, and which can use standing permissions?
The practical divide follows risk and reversibility. Read operations — retrieving records, drafting a transaction for human review, generating a report — typically carry lower risk and can proceed under broader standing permissions. Irreversible or high-consequence actions — executing a payment, changing a user’s identity credentials, releasing personally identifiable information, completing a securities trade, or modifying access controls — are the candidates for per-action authorization with a narrow scope, a short validity window, and rate limits. The guiding principle is the same one behind the Principle of Least Privilege, formalized in computer security since the 1970s: any actor, human or automated, should have access only to what is necessary for the specific task at hand, no more, and no longer than needed.