One primitive. Five places it changes the answer.
Every one of these starts from the same gap: between the last identity check and the executed action, your stack is making an assumption. Each page below is where that assumption costs something specific, and what replaces it.
Action Authorization
A session can be delegated to an agent. Authorization cannot.
An agent inside a valid session can obtain every credential it needs to act. It cannot obtain a fresh biometric press from an enrolled human on a bound device. That press is the gate.
Teams putting agents on destructive, financial or data-egress operations.
The agent mandate
The agent gets autonomy. The human keeps the boundary, signed.
A signed grant defining exactly what an agent may do, up to what ceiling, until when. It can spend the authority. It cannot widen it, extend it, or reissue it to itself.
Autonomous workflows that cannot pause for a human on every call.
Protected screens
A signature over a request the user never saw proves nothing.
The approval surface is rendered outside the calling application's control, and the signature covers the rendered content itself. What appeared on screen and what reached the server are one object.
Payment confirmation, clinical sign-off, any approval where the display is the control.
Privileged access
The session identifies. The signature authorizes.
Elevation stops being a state that lasts for hours. Each consequential operation carries its own proof from the named operator, hash-chained to the one before it.
Production access, secrets, break-glass, permission changes.
Payment authorization
Authenticating the payer is not authorizing the payment.
A signature computed over the payee and the amount, plus a hash of what the payer was shown. Dynamic linking that is cryptographic rather than procedural.
PSD2 Article 97, APP scam liability, agent-initiated purchases.
Not sure which one you are?
Most teams arrive with a flow rather than a category: a transfer they cannot defend in a dispute, an agent they cannot let near production, an admin action they cannot attribute. Describe the flow and we will tell you which of these applies, or that none of them do.