Abstract

In one line: A request can be delivered perfectly, over an encrypted HTTPS connection, to a genuine server, carrying a valid OAuth token, and still represent an action that nobody ever authorized. This disclosure adds the missing layer: each specific action is held until it is approved for that exact effect, at that exact destination, at that moment.

Filing history. The parent application, PCT/IB2026/055615, was filed on 4 June 2026 and published by WIPO on 16 July 2026 as WO 2026/150382. Its specification runs to 8,598 pages and sets out more than 300 distinct embodiments. It builds on an earlier application covering the Algorithmic Logic Fingerprint (ALF), PCT/IB2026/053385, filed on 7 April 2026 and published on 4 June 2026 as WO 2026/115520. The parent was followed by eight more PCT applications and multiple Indian patent applications, together comprising more than 10,000 pages of non-repetitive disclosure.

Why Existing Security Is Not Enough

Each core internet standard answers one question. TCP/IP: how is the data delivered? TLS and HTTPS: is the connection encrypted, and is the server who it claims to be? OAuth: has this client been granted access? EMV: is this payment card or credential genuine? Distributed ledgers: what happened, and in what order? The missing question is: is this specific action allowed to take effect, right now, at this destination?

TLS protects the channel, not the consequence. It confirms that data was not read or altered in transit and that the endpoint is authentic, but it says nothing about whether the request inside, such as an AI agent's API call, a data export, a payment or a network reconfiguration, should be executed at all. OAuth grants broad access for a period of time; it does not approve each individual action. Logs and SIEM alerts record actions after they happen, which is too late when AI systems act in milliseconds.

The Disclosed Layer

This technical disclosure presents a computer-implemented pre-execution authorization layer that closes this gap without replacing any existing protocol. Every proposed operation, whether an AI output, tool call, API request, file export, database write, payment instruction, network packet, telecom transmission or actuator command, is held in a pending state with no external effect.

A protected enforcement domain, such as a hardware root of trust, trusted execution environment or isolated security component, checks the applicable conditions: authorization, purpose, consent, jurisdiction, destination, revocation status, policy version, runtime integrity, freshness and quota. Only if all checks pass does it issue a single-use, non-bearer capability bound to that exact operation and to the specific enforcement point where it would take effect, such as an API gateway, egress proxy, SmartNIC or DPU, telecom gateway, payment terminal, storage or memory controller, or actuator interface. The enforcement point verifies and consumes the capability as the operation executes; otherwise the operation is blocked (fail-closed).

Example: an AI agent holding a valid OAuth token prepares an export of customer records to an external address. The request is well-formed and travels over valid TLS, but the destination's jurisdiction is not permitted for that data's purpose. No capability is issued, and the egress proxy blocks the export before any byte leaves.

Applications and AI models can still compute and prepare actions, but they no longer hold the authority to make them happen.

Scope

The full specification, an 8,609-page international patent application published by the World Intellectual Property Organization as WO 2026/150382, includes embodiments for AI agents, cloud and data-center hardware, 5G/6G and satellite networks, payments and digital assets, data sovereignty, industrial control, robotics and critical infrastructure.

The technical contribution is per-action, pre-execution authorization enforced at the last point before effect, using single-use, non-bearer capabilities issued by a protected enforcement domain, complementing rather than replacing transport security, access delegation and identity management.

Related publications and applications: full specification, navigation guide and review package at https://zenodo.org/records/23245054 ; PCT/IB2026/055615 (published as WO 2026/150382); and follow-on applications PCT/IB2026/055760, 055870, 056058, 056571, 056771, 056809, 056941, 057198, 057540 and 058236.

Author: Sangam Kumar Das, Independent Researcher, Balasore, Odisha, India. Open to acquihire, strategic collaboration, licensing or joint development with organizations building AI-agent, cloud, network, payment or critical-infrastructure security: [email protected], +91-9861363532.

KEYWORDS

TLS protects the channel not the consequence; pre-execution authorization; per-action authorization; action-level authorization; missing authorization layer; beyond TLS; beyond HTTPS; beyond OAuth; transport security limitations; OAuth limitations; authenticated is not authorized; AI agent security; agentic AI governance; AI tool call authorization; MCP security; Model Context Protocol; API gateway; API security; egress control; egress proxy; policy enforcement point; reference monitor; zero-trust architecture; hardware root of trust; trusted execution environment; TEE; confidential computing; remote attestation; single-use capability token; non-bearer token; operation-bound capability; destination-bound authorization; replay protection; fail-closed enforcement; pending state; non-effective state; time-of-check to time-of-use; TOCTOU; purpose limitation; consent enforcement; jurisdiction enforcement; revocation; policy version; quota enforcement; data exfiltration prevention; data loss prevention; data sovereignty; cross-border data transfer; payment authorization; payment finality; EMV; digital assets; CBDC; 5G security; 6G security; network slicing; telecom gateway; satellite command security; non-terrestrial networks; SmartNIC; DPU; memory controller; industrial control system security; actuator command authorization; robotics safety; critical infrastructure protection; AI safety; EU AI Act; execution finality; prior art; defensive publication

CPC CODES (author-suggested)

G06F 21/53; G06F 21/57; G06F 21/604; G06F 21/6218; G06F 21/6245; G06F 21/71; H04L 63/10; H04L 63/20; H04L 63/0281; H04L 9/3213; H04L 9/3228; H04L 9/3234; H04W 12/08; H04B 7/185; G06Q 20/38; G06Q 20/40; G05B 19/042; B25J 9/1674

IPC CODES (author-suggested)

G06F 21/53; G06F 21/57; G06F 21/60; G06F 21/62; G06F 21/71; H04L 9/32; H04L 9/40; H04W 12/08; H04B 7/185; G06Q 20/38; G06Q 20/40; G05B 19/042; B25J 9/16

These classification codes are author-suggested search classifications, not official classifications assigned by a patent office.

Recent public AI-agent architectures from major technology companies likewise separate agent computation from the authority to act, suggesting industry convergence on this principle.

Creative Commons License

Creative Commons License
This work is licensed under a Creative Commons Attribution-Noncommercial 4.0 License

Download

Share

COinS