And soon, your AI agents will need a cosign too.
The money-movement firewall is the beachhead. The authorization layer for the entire agentic economy is the company. The same rail that halts a deepfaked CEO halts an autonomous agent acting on its own authority.
The problem agents create
Autonomous agents are starting to initiate real money movement — paying invoices, changing vendors, provisioning access. A prompt-injected, jailbroken, or simply mistaken agent can do all of that at machine speed, with credentials you issued it. Detection-based controls were never designed for an attacker that holds a valid token.
The same deterministic answer
COSIGN does not ask whether an agent is trustworthy. It halts the consequential action and requires a verifiable, policy-bound cosign — from a named human, or from a higher-trust agent under an explicit policy — before anything moves. Routine, in-policy actions flow normally; only the risky path stops.
The agent-action cosign API
Enterprise tier exposes a single authorization call. Submit the action; COSIGN evaluates policy, halts what crosses your thresholds, gathers the required cosigns, and seals the decision in the ledger.
POST /v1/actions/authorize
{
"actor": "agent:ap-clerk-7",
"action": "wire.transfer",
"amount": 2400000,
"currency":"USD",
"to": "acct_new_unverified",
"policy": "treasury.over_threshold"
}
→ 202 { "status": "halted",
"cosign_required": ["human:controller", "human:cfo"],
"quorum": "2-of-3",
"ledger": "0x9f3a…c41" }Built to interoperate, not compete
Card-network rails — Visa Intelligent Commerce, Mastercard Agent Pay, Google's Agent Payments Protocol (AP2) — authorize consumer agent-to-merchant checkout. None govern the internal treasury, AP, payroll, and identity actions where enterprise money actually leaves. COSIGN is the human-halt enforcement layer for that internal surface, and is designed to sit alongside those mandate chains rather than replace them.
Humans today → Agents next → The cosign standard
We are onboarding design partners for the agent-action API. If autonomous systems are starting to touch your money or your access, the time to put a deterministic gate in front of them is before, not after.