In 2025, Anthropic published Zero Trust for AI Agents, a comprehensive security framework for deploying autonomous AI agents in the enterprise. It is one of the most rigorous documents the AI security space has produced. It covers agent identity, authentication, access control, privilege scoping, observability, behavioural monitoring, input validation, output filtering, configuration integrity, and governance policies across three capability tiers.
It also contains, buried in the Advanced tier of the output filtering section, the following requirement:
"Human-in-the-loop approval for high-risk actions - Require human review before executing actions with significant consequences. Present clear descriptions of intended actions. Log approval decisions for audit."
That is GoFirm's functional specification, written by the company that builds the most widely deployed AI agents in the world. They have identified the requirement precisely. They describe it as an Advanced tier capability - the highest tier, reserved for regulated industries, national security applications, and deployments where a breach carries severe operational or financial consequences.
The framework also poses a design test that every security control should answer: does this make the attack impossible, or just tedious? The document is explicit that controls whose value comes from friction - rate limits, extra hops, SMS-based MFA - degrade significantly against an adversary that can operate at scale with near-zero per-attempt cost. The controls that survive the test share a pattern: hardware-bound credentials, expiring tokens, cryptographic identity, and paths that do not exist rather than paths that are merely inconvenient.
GoFirm passes this test. A compromised credential cannot produce a biometric confirmation from a named authority on their registered hardware-bound device. A rogue agent cannot produce it. An attacker who has successfully navigated every upstream control and is about to execute a consequential action cannot produce it. The attack is not made tedious. It is made impossible at the execution boundary.
The framework also identifies escalation triggers as a required design element: "High-value transactions, access to sensitive data categories, or communications with external parties might all require approval." It points to configuration files as the implementation. GoFirm is the implementation - biometric, out of band, deterministic, permanently recorded.
What Anthropic's framework does not do - and is not designed to do - is tell an organisation how to make that human-in-the-loop approval mechanically enforced rather than procedurally assumed. A settings file can specify that human approval is required. It cannot guarantee that the approval came from the right person, on a registered device, through a separate channel, with a signed record that the decision was made. That is the gap between the specification and the product.
There is a second point the framework makes that is worth examining carefully. It was written assuming the organisation will build, configure, and maintain every control described within it. The tiers are detailed, rigorous, and comprehensive. They also require significant security engineering expertise, sustained operational investment, and a team capable of implementing controls across identity, network, infrastructure, agent runtime, and governance simultaneously.
Many organisations deploying AI agents do not have that team. The framework acknowledges this implicitly - the Foundation tier is described as the minimum viable entry point, and even it assumes short-lived tokens, cryptographically rooted identity, and identity-based isolation are already in place.
GoFirm inverts this model. The human authority confirmation gate, the out-of-band channel, the biometric device binding, the N-of-N orchestration, the signed permanent record: none of it requires the organisation to build anything. Three lines of code and a configuration in the admin panel. The architecture is GoFirm's. The organisation defines which actions matter and who the authorities are.
Anthropic wrote the specification. The requirement for human authority confirmation at the execution boundary of high-consequence AI actions is now documented by the organisation building the agents themselves. GoFirm is the product that delivers it.
GoFirm is The Authority Platform. Stop unauthorised action. Every time.
In association with Osinto.ai, the collective intelligence platform for Security, Resilience & Defence. Osinto’s AI-enabled open-source network and governed collaborative operational environment help mitigate the growing security, resilience and governance obligation in minutes, not months.
References
1. Anthropic, Zero Trust for AI Agents, 2025 — Part III, Output Filtering, Advanced Tier
2. Anthropic, ibid. — The Principles Behind Zero Trust: A Design Test
3. Anthropic, ibid. — Part IV, Phase 3: Define Agent Boundaries, Escalation Triggers