What is cryptographic proof that a human approved an action?
It is a digital signature produced by a specific human, on their own device, over a description of the exact action they approved. It is generated at the moment of approval, gated by a fresh biometric, and verifiable by anyone against a published public key. It does not depend on trusting the platform's logs or a probability score.
The distinction that matters
A policy gate records that an action was allowed. A login check records that someone authenticated earlier. Neither proves who approved the action that moved the money, prescribed the dose, or granted the privilege.
Yuthent produces that proof: a hardware-bound, action-bound signature of a specific human, generated at the moment of execution, that an attacker cannot forge and an agent cannot fabricate.
The four properties of a real proof
Produced by the human
The signing key is held and exercised by the specific human, on hardware they control. The platform does not sign on their behalf.
Bound to the action
The signature covers a canonical description of the exact action. A bearer credential that could have authorized anything does not qualify.
Independently verifiable
A third party can verify the proof against a published public key, without trusting the platform's systems or the customer's good faith.
Non-repudiable
The key lives in hardware and requires a fresh biometric to use. The signer cannot credibly deny having produced the proof.
Yuthent generates this proof with a hardware-bound key on the user's device, using a standards-based ECDSA P-256 signature over the action. The proof can be appraised later, offline, by any party holding the public key.
Where this proof is required
Regulated systems increasingly demand evidence the platform alone cannot author. PSD2 SCA dynamic linking asks for a signature bound to the amount and payee. DEA EPCS asks for a non-repudiable signature per prescription. HIPAA audit controls and SOX attestations ask who approved what, provably. A cryptographic per-action signature answers all of them with one primitive.
Yuthent is Execution Authority Infrastructure. It produces this proof on iOS and Android, alongside your existing systems, and every engagement starts with a scoped first deployment.
Common questions
What is cryptographic proof that a human approved an action?
It is a digital signature produced by a specific human, on their own device, over a canonical description of the exact action. It is generated at the moment of approval and gated by a fresh biometric. Anyone holding the published public key can verify it, including an auditor, a regulator, or a court, without trusting the platform that produced it.
How is this different from a log entry or a risk score?
A log entry is the platform's own record that something happened. A risk score is the platform's opinion about how likely fraud is. Both are produced by the platform and can be wrong or disputed. A cryptographic signature is produced by the human's device with a key the platform does not hold, so it stands as independent evidence.
What makes the proof non-repudiable?
The signing key is held in device hardware and can only be exercised with a fresh biometric gesture from the enrolled human. The signature is bound to the specific action. The holder of the key cannot credibly deny having produced it, and an attacker without the device and the biometric cannot produce it at all.