We’re all hyped about Claude Mythos and autonomous agents, but the current security stack is basically a "trust me, bro" system.

If you look at the IETF drafts (WIMSE, AIP), everyone is worried about how a service trusts an agent. But nobody is talking about the User-to-Operator gap. Right now, the flow is: User → Operator → Agent.

The Operator is essentially a "God-mode" middleman. They can tweak your prompts, expand your permissions, or just ignore your boundaries before the agent even sees them. If you’re building for healthcare (HIPAA) or finance (PCI), this "unchecked authority" is a total dealbreaker.

The Solution:

I got fed up and built AuthProof.dev. It’s an open-source SDK that uses Delegation Receipts to lock the user’s intent before it ever touches the operator.

What’s actually under the hood:

• Layer 1 (The Manifest): Tool servers sign their capabilities. The operator can't lie to you about what a tool can actually do.

• Layer 2 (The Receipt): You sign a cryptographic anchor with your Phone/Laptop’s Secure Enclave (WebAuthn). It sets hard boundaries that the agent cannot "reason" its way out of.

• Layer 3 (The Sandbox): It uses Safescript execution. If the agent tries to run a program that doesn't match the cryptographic hash you authorized? It just fails. Math beats jailbreaking.

• The Audit Trail: It generates a signed "Action Log" (taint analysis). It tracks data from ingestion to egress so you can actually prove you’re GDPR/HIPAA compliant.

Why I’m sharing this:

I’ve got 573 tests passing and the core SDK is live on NPM, but I need to know if I’m over-engineering this or if other devs are feeling this "trust gap" too.

If you’re building "High-Stakes" agents (stuff that actually touches real money or private data), I’d love for you to poke

holes in this.

• Site: AuthProof.dev

• Docs/Code: github.com/Commonguy25/authproof-sdk

• Install: npm install authproof-sdk

Is "cryptographic proof" the way forward, or are we just going to keep crossing our fingers and hoping our system prompts hold up?