The session is valid. The action was never approved by a human.
A valid session proves someone authenticated earlier. It does not prove who approved a specific action later. Authority established at login inherits to every action that follows, including actions taken on a hijacked session or by an autonomous agent. Yuthent closes this inheritance gap by requiring a fresh, per-action human signature at execution time.
A concrete example
A supervisor logs in at 8 AM. At 3 PM, someone else approves overtime on the same session. The session is valid. The supervisor was not present. Every log will show the supervisor's identity, because the session carried it forward.
The same shape covers session hijacking, cookie theft, remote-control malware, MFA fatigue, and an AI agent operating inside a trusted session. In each case the credential is valid and the authority outlived the human.
The distinction that matters
A login check records that someone authenticated earlier. A policy gate records that an action was allowed. Neither proves who approved the action that moved the money, prescribed the dose, or granted the privilege.
Yuthent produces that proof: a hardware-bound, action-bound signature of a specific human, generated at the moment of execution. Authority is temporal, not persistent, so it is proven again for each action that matters.
How Yuthent closes the gap
Your backend policy marks which actions require a fresh human signature. When one of those actions is reached, the enrolled human approves with a fresh biometric, and the device signs the exact action with a hardware-bound key. The backend verifies the signature before the action executes. A valid session with no valid signature is not enough to act.
Yuthent is Execution Authority Infrastructure. It composes with your session and fraud stack, and every engagement starts with a scoped first deployment.
Common questions
Can a session be valid while the action was never approved by the account holder?
Yes. A session is a bearer token issued at login. Anyone who holds it, an attacker who stole it, a remote-control operator, or an agent acting inside it, carries the authority of the original login. The session stays valid while the human who started it is no longer the one acting.
What is the inheritance gap?
Authority proven once at login inherits to every action that follows in that session, with no fresh check. The inheritance gap is the distance between the moment a human authenticated and the moment a sensitive action executes. Yuthent removes the inheritance by proving authority again, per action, at execution time.
Does this replace the session?
No. The session remains the right mechanism for carrying identity through a flow. Yuthent adds an evidence layer beneath it. The session identifies. The per-action signature authorizes. They compose, and the session keeps doing its job.