Biometric authorization is emerging as a control layer for AI agents, according to a new Biometric Update analysis, which maps products connecting a person’s liveness or biometric verification to an agent’s delegated actions.
The reported approaches combine several components rather than relying on biometrics alone. Biometric Update describes tools using liveness detection, cryptographic credentials and authorization policies to create an auditable connection between an authorized human and activity performed by an agent. The roundup names products from iProov, World, Seventh Sense, Token, Proof and Microsoft, while also noting research into delegated authorization for robots and other AI systems.
The evidence currently described is mostly product activity and vendor claims, not independent testing. For example, Biometric Update reports that iProov’s HAPS implementation connects biometric liveness to agent authorization through integrations with agentgateway and Cerbos. It also says World has released World ID for Agents for banking and finance, while Seventh Sense presents SenseCrypt as combining passkeys with privacy-preserving biometrics and an audit trail.
A related Biometric Update report provides more implementation detail on two of the products. Token says its TokenCore Card uses on-device fingerprint verification with FIDO2 passwordless authentication and signed authentications, and claims setup takes less than five minutes while multifactor logins take less than two seconds. Proof says its X401 protocol provides identity verification and signed transaction authorization for agents, with a digital identity wallet and a production Model Context Protocol server.
Those details describe how the vendors say their systems work; they do not establish that the products prevent unauthorized agent behavior in operational environments. The reports also do not provide comparative biometric error rates, privacy-preserving data-handling requirements, revocation procedures or evidence from independent evaluations. Buyers would need those details, along with compatibility information for existing identity, access-management and policy systems, before treating biometric authorization as a mature control rather than an emerging product category.