Dave, the ELAH mascot, peeking up from the corner

ELAH — Verified agent access

Soon, web browsers will be built for agents.

The CAPTCHA question won’t be“Are you human?”

It will be“Are you doing what a human requested from you?”

Talk to ELAHSee how verification works

Weekly Newsletter

  • Signed requests
  • Delegated grants
  • Scoped actions
  • Revocable

The CAPTCHA problem

CAPTCHAs ask “are you human?” AI agents just say yes.

Checkbox and image puzzles were built to keep scripts out. Today an agent clicks the box, reads the grid, and passes in seconds, and the site still knows nothing about who sent it or what it may do.

portal.example.com/support/new0.0s
I’m not a robotCAPTCHA
Privacy · Terms

Select all squares with

traffic lights

Verify

agent.log

  • $ agent run --task 'open support ticket'
  • ▍

Same request, ELAH-protected

headless script · no grantwaiting
support-agent · signed grantwaiting

No puzzle to solve. ELAH asks for proof of delegated, scoped permission instead.

  • ≈100%

    of reCAPTCHA v2 image challenges solved by an off-the-shelf object-detection model in a 2024 study.

    Plesner, Vontobel & Wattenhofer · ETH Zürich, “Breaking reCAPTCHAv2” (2024)

  • Faster

    and more accurate than people: bots out-solved human participants on several common CAPTCHA types.

    Searles et al. · UC Irvine, USENIX Security (2023)

  • Hired help

    An AI model persuaded a human worker to solve a CAPTCHA for it during pre-release safety testing.

    OpenAI · GPT-4 System Card (2023)

The product

CAPTCHA

  1. CCompletely
  2. AAutomated
  3. PPublic
  4. TTuring test to tell
  5. CComputers and
  6. HHumans
  7. AApart

A security check that verifies an AI agent has the user’s approval to perform a specific action—and that the request stays within the limits of that approval.

The name also sounds like “a pact”: an agreement defining what the agent is allowed to do.

The shift

The web needs an answer beyond “Are you human?”

Old web

  • Is this a human?
  • Keep bots out
  • Session-based access

Agentic web

  • Is this a known agent with valid delegated permission?
  • Let legitimate agents into bounded workflows
  • Short-lived, request-bound access

How ELAH works

A grant, a signature, then the platform decides.

ELAH sits where a protected action is about to run. Delegation, verification, and the platform’s own decision are the steps that carry the trust.

  1. 01

    Discover

    The protected platform declares how it accepts agent access and which scopes it supports.

  2. 02

    Approve

    The user or organization approves a narrow task in the platform's consent experience.

  3. 03

    Delegate

    A short-lived grant is created for the agent key, target site, tenant, permitted actions, and limits.

  4. 04

    Sign

    The agent signs each protected request and presents the grant.

  5. 05

    Verify

    ELAH checks signature, issuer, audience, expiry, nonce freshness, scope, resource constraints, action binding, and revocation.

  6. 06

    Decide

    The partner applies its own business policy: proceed, require fresh approval, limit, or reject.

  7. 07

    Revoke

    The principal or platform can withdraw future access. ELAH records the authorization and the attempted protected action.

Trust chain

  1. Principal
  2. Delegated grant
  3. Agent public key
  4. Protected site
  5. Permitted action
  6. Signed request

Every link matters. A grant for another site, tenant, agent key, action, or time window fails verification.

What the platform verifies

Bound to this agent, this principal, this action.

  • 01

    Agent identity

    The request is signed by an identified agent public key.

  • 02

    Delegated principal

    A person or organization stands behind the grant.

  • 03

    Site and tenant binding

    The grant names this partner site and this tenant.

  • 04

    Action scope and limits

    Permitted actions, resources, and optional count, value, or duration limits.

  • 05

    Freshness and replay protection

    A short expiry and a nonce, so a captured request cannot be reused.

  • 06

    Revocation state

    A withdrawn grant fails before the protected action runs.

Signed agent request

hover a check

POST /api/tickets HTTP/1.1
Signature-Agent: support-agent.acme.example
Host: portal.example.com
Content-Digest: sha-256=:X48E9q…:
Signature-Input: sig=("@method" "@path" "content-digest");
  created=1791200400;expires=1791200520;nonce="b3k2…"
Signature: sig=:MEUCIQ…:
 
Agent-Grant: grant_7f3a · status=active
  principal  org_acme / user_maya
  audience   portal.example.com
  tenant     acme
  actions    ticket.read, ticket.create
  resource   customer.own · max 5
  expires    120s
verified · scope_okplatform decides next

The product boundary

ELAH verifies delegated, scoped access.

It does not claim to read an agent’s private reasoning or replace the platform’s own policy.

ELAH can prove

  • ✓This request was signed by a known agent key
  • ✓A principal delegated this action to that agent
  • ✓The grant names this site, tenant, and scope
  • ✓The request is fresh and has not been replayed
  • ✓The grant has not been revoked

ELAH does not claim to

  • –Read an agent’s private reasoning
  • –Replace the platform’s own policy or IAM
  • –Execute the protected action for you
  • –Act as a global registry of every agent

Make agent access verifiable before the protected action runs.

Start with one narrow workflow. Keep the platform in control.

Talk to ELAH