Agent Trust Layer
The question in the agent era isn't "who logged in," but "who is authorized to do what, on whose behalf."
AI agents send email, change budgets, and cancel orders on a user's behalf. What's needed here isn't more login screens. It's a separate trust layer that handles the moment of delegation.
logi builds this layer on three principles.
Principle 1 — People and agents are distinct principals
Handing a user's token to an agent wholesale leaves only "the person did it" in the record. logi treats the person who approved and the agent that executed as separate principals from the start.
- Login belongs to the person — passkeys, two-factor authentication, sign-in history.
- Action belongs to the agent — which agent, which tool, what scope.
- Both are recorded.
Principle 2 — People are called in only at irreversible moments
Requiring approval for every action just trains users to tap [Allow] out of habit. That's not security — it's notification fatigue.
logi's criterion is irreversibility.
| Action | Handling |
|---|---|
| Reads, drafting, repetitive tasks | Rules the user has set handle it — no human called |
| Money transfers, deletions, outbound sends, account changes | One more confirmation on the user's phone |
When confirmation is needed, approval happens on the user's phone, not a browser redirect. It arrives as a push, is signed with a passkey, and high-risk approvals bind the screen to the decision with number matching. Agent Approval Gate is the implementation of this flow.
Principle 3 — Every decision leaves evidence
If "what the agent did" can't be reconstructed later, delegation is a gamble. logi's design principle is that the entire approval flow remains a single chain.
Request created → user approves/rejects → execution → result- Exactly what the user saw is sealed with SHA-256.
- Approvals and rejections are kept in the audit record as signed decisions.
- Panopticon traces and sign-in history support post-hoc audits.
What's available today
| Need | Feature |
|---|---|
| User confirmation before an agent's consequential action | Agent Approval Gate |
| Observability and policy for agent actions (rate limits, scope-drift blocking) | Panopticon |
| Calling logi functionality via MCP | MCP server (@1pass/mcp) |
| Managing the user's connected apps and sign-in history | Built into the 1pass app |
Standards stay on the existing track — OAuth 2.1 + PKCE, short-lived tokens, audience pinning. logi tracks agent-delegation standards (the OAuth On-Behalf-Of draft, MCP authorization extensions) without tying the product to specs still in draft.