Step-up re-authorization for sensitive actions
Pausing an agent at the sensitive or irreversible step and putting that one decision back in the user's hands, at a confirmation strength matched to the stakes. Routine actions proceed on the standing grant; consequential ones wait for the user.
The impact of agents
As agents act under a standing delegation, some of the actions they take will be sensitive or irreversible while most are routine: viewing a tax return status is low-risk; lodging an amended return is not. The difficulty is re-inserting a human decision point for the high-stakes actions without forcing the user to confirm every routine one.
What must be verified
For a high-stakes or irreversible action, an agency needs confidence that the user, not the agent alone, authorized this particular step, with the strength of that confirmation proportionate to what is at stake. The agency performing the authentication challenge must run and hold that step-up confirmation itself.
Protecting access
A step-up challenge assumes the user can receive it and answer in time. No smartphone means no push or SMS challenge. A tight response window fails people who need longer to read, move, or decide. In each case, the confirmation step blocks the exact action the user meant to authorize.
Keeping the path open
- Offer challenge channels beyond the phone: email, a phone call, in person at a shopfront.
- Measure response windows in hours rather than minutes for actions that aren't time-critical.
- Let the user set a pre-approved actions list during delegation setup, so routine steps don't generate challenges at all.
- State plainly in the challenge, whatever channel it arrives by, what the agent is asking to do and what confirming will commit the user to.
Response surface
Each requested action is routed by its sensitivity, so a routine lookup proceeds on the delegation alone and an irreversible one stops for fresh authentication.
TaxBot wants to lodge an amended 2025 tax return on your behalf
This changes a return you have already lodged. It is classified as sensitive and needs your approval before it goes ahead.
Set when you set up the delegation. Sensitive actions can never be pre-approved.
Each service’s risk level is set in advance by the owning agency and can be read in the interface. It reflects the real-world stakes and stays the same for everyone.
Maturity
- Established
For demanding stronger authentication at a sensitive action.
- Emerging
As applied to human-agent delegation in tax.
- Frontier Headline
As applied to an AI agent that must confirm asynchronously.
Precedents
OpenID Connect step-up authentication. A step-up maps
to the NIST authentication assurance levels: a user at AAL1 with a password
alone is challenged to reach AAL2 with a second factor before a sensitive
action. In OIDC it is carried by the acr_values or max_age parameters
on the authorization request, and RFC 9470 defines the
challenge a resource server returns. Common triggers are high-value
transactions, access to personal or medical records, and account
modifications.
Open Banking UK Strong Customer Authentication. PSD2 mandates Strong Customer Authentication for payment initiation and certain data access, and the bank performs the challenge, not the third-party provider. The Customer Experience Guidelines document the redirect-to-SCA step as it runs in production. The party holding the account confirms the action, so the confirmation cannot be produced by the software that asked for it.
What carries over to agent use
Step-up re-authorization is directly transferable. The pattern: the agent presents its delegation token; the service evaluates the requested action against a sensitivity classification; low-sensitivity actions (view, status check) proceed on the token alone; medium-sensitivity actions (submit, amend) interrupt the agent's flow and contact the user directly (push, SMS, email) for confirmation; and high-sensitivity actions (irrevocable decisions, large payments) require the user to re-authenticate at a higher assurance level and explicitly confirm.
The HMRC granular-authorization model shows this is already being designed for human tax agents, and extending it to AI agents is a natural step.
The open problem is latency. Step-up authentication in open banking works because the human is present at the keyboard. For an AI agent operating asynchronously, a step-up challenge introduces a delay the agent must handle gracefully: pause, notify the user, wait for confirmation, then resume.
Where things go wrong
The risk is an agent silently executing high-stakes, irreversible decisions en masse with no human in the loop. Forcing the user to re-authenticate and explicitly confirm such actions reintroduces a human decision point before harm is done. An agent that triggers enough of these challenges can induce alert fatigue, training the user to approve on reflex rather than read. A challenge delivered to a channel the agent also monitors, such as an email inbox it can read, can be intercepted and cleared before the user ever sees it.
Sources
5 references
The instrument, the operating deployment, or the official record itself.
Writing about the subject rather than the framework itself, including vendor commentary.