Human checkpoints
Pause the agent workflow, complete the step-up procedure, and resume only after your backend accepts the authentication, checks permissions, and confirms any action approval required by your policy. This works with your existing sign-in or World ID as your primary sign-in.Optional: collect action approval in your application
Save the exact action, version, destination, owning account, and expiry, bound to the authentication attempt. After validating the account and assurance, show the saved action to the user and record their approval or denial. At execution, recheck permissions, expiry, freshness, and approval, and authorize only that version. Changes require new approval. Denial, cancellation, failed validation, or expiry leaves the action blocked. Apply the one-use and retry rules. Formax_age=0, authentication belongs to the newly initiated attempt. Enforce
your application’s freshness window when the action runs, including time spent
reviewing it.
For headless clients, follow the Device Authorization Grant.
Your backend issues their API or MCP credentials. Where supported, use the
challenge and retry flow.