{
  "slug": "proof-of-human-intent",
  "title": "Proof of human intent: how to prove a person authorised an action",
  "summary": "Authentication proves who logged in. It never proves who meant this. A complete guide to per-action human authorisation, what it fixes, and what it does not.",
  "lede": "Every authentication system in production answers the question \"who is this?\" at the moment a session begins. Almost none of them answers the question that actually matters when money moves, which is \"did a person mean to do this specific thing?\" This page is about the difference between those two questions, why the gap between them is where the losses live, and what closing it looks like in practice.",
  "date": "2026-10-02",
  "reading_time": "22 min read",
  "category": "Pillar",
  "tags": [
    "proof of human intent",
    "per-action authorisation",
    "transaction signing",
    "session hijacking",
    "business email compromise",
    "payment authorisation",
    "WebAuthn"
  ],
  "image": "https://cdn.twc.sh/images/igcache/Proof%20Of%20Human%20Intent/1200_630/blog.jpg",
  "url": "/blog/proof-of-human-intent.html",
  "wordcount": 6107,
  "related": [
    "identity-failure-map",
    "wedge-fit-ic3-reread",
    "session-theft-aitm"
  ],
  "schema": "Article"
}