Stop Letting Your AI Agent Forge Human Approval

2:47am. Your support agent issues a $500 refund. Compliance asks: "Who approved this?" You check the logs. Valid OAuth token. Agent was authorized to access Stripe. But nothing says a human approved this specific refund . That's the gap. Session auth proves capability. It doesn't prove approval. I built AgentMint to close it. How it works Human clicks approve → AgentMint signs a token: { "sub" : "alice@company.com" , "action" : "refund:order:123:max:50" , "exp" : "60 seconds" , "jti" : "f1268944-..." } Agent includes token in the API call. Downstream verifies: Signature valid? (Ed25519, can't forge) Expired? (short-lived, can't hoard) Already used? (JTI tracked, can't replay) Passes → action executes, audit log updated. Fails → blocked. ~3ms verification. Single-use. Cryptographic proof of who approved what, when. Who needs this Industry Blocked action Why they're stuck Fintech Refunds, credits Can't prove human approved specific transaction Healthcare Record amendments HIPAA audit tra