Confirm Gate: typed-session rules for support agents that move money

The Confirm Gate SDK idea sits between two groups of players. Full AI support platforms such as Lorikeet, Decagon, Sierra and Fini already sell to neobanks and fintechs, and they market identity checks scaled to risk, deterministic eligibility rules, human-approval thresholds and replayable audit trails. A CX lead who already uses one of them will mostly get this as a built-in feature. On the other side, general agent-authorization tools such as Auth0's CIBA-based asynchronous authorization, and open-source demos like AgentGuard, already handle "pause the tool call until the user approves this specific action." So a generic gate SDK is easy to copy, and the platforms will probably absorb it. Room remains in a few places. One is a platform-neutral layer for companies that build their own support agents or run several vendors at once. Another is the evidence itself: a hashed customer confirmation tied to a specific proposed action, formatted for regulators, examiners and chargeback or Reg E disputes. That is a stronger promise than an internal tool-call log, and none of the vendors I found pitch it that way. The pay-per-resolved-case pricing also clashes with the platforms, which already charge per resolution. Selling to compliance or risk teams, rather than CX automation leads, would be easier to defend. Mandate Record looks emptier and more timely. In October 2026, reporting said large US banks had found third-party AI agents in customer accounts, including one that called a bank with a complaint without first consulting the account holder. JPMorgan has moved to block outside agents. I found no bank or regulator guidance and no product that asks for and checks proof of a customer's mandate before a complaint submitted by an agent is routed. The existing precedents are paper third-party authority forms (CBA, HKMA). AP2 mandates, Truvera, Mastercard Verifiable Intent and Visa's Trusted Agent Protocol cover purchase authorization, not complaints or servicing requests. A product that accepts those credentials where they exist, and otherwise falls back to a confirmation step back to the customer, could win at card issuers' complaint operations before the networks or Auth0-style identity vendors extend into this.

• Lorikeet

  An AI support agent built for fintech. The company says about 80% of its customers are US financial institutions and fintechs, including Step, TapTap Send and Airwallex. Its own materials describe identity checks that get stricter as the requested action gets riskier, deterministic eligibility checks, human-approval thresholds for high-risk actions, and a timestamped, replayable audit trail of every tool call. This is the closest match to the Confirm Gate buyer, but it comes bundled inside Lorikeet's full agent platform rather than sold as a standalone SDK.

• Decagon

  An AI support platform built around Agent Operating Procedures. A competitor's comparison page describes it as having hard-coded action verification. Refund actions are built through custom actions, so whether a confirmation is required depends on how each customer sets it up. The source is a competitor's writeup, not Decagon's own documentation.

• Sierra

  A major AI customer service agent vendor that sells into regulated industries. I could not find first-party details on how it gates refunds or confirms actions with customers. It is a likely place for a gating feature to appear inside the platform.

• Fini

  An AI support vendor that publishes guides on automating refunds, cancellations and account updates. It argues that eligibility should be decided deterministically. It competes as a full agent, not as a gating layer.

• Auth0 for AI Agents (Asynchronous Authorization)

  Uses the CIBA standard plus Rich Authorization Requests so a tool call pauses until the user approves a specific action (for example, 'Approve payment of $50.00') on a trusted device. SDK helpers such as withAsyncUserConfirmation exist for Vercel AI and Genkit. This already covers the 'explicit customer confirmation before execution' step as a cheap developer building block. It does not include support-specific state machines or evidence records.

• AgentGuard (MCP server demo)

  An open-source demo that layers agent identity, OAuth scopes, contextual policy and human approval in front of tools. Its example blocks an agent from issuing a refund without the right scope. This shows the gating pattern is easy to reproduce.

• Google AP2 (Agent Payments Protocol) mandates

  Cryptographically signed Intent, Cart and Payment Mandates that prove what a user authorized an agent to do. They are explicitly meant to support dispute handling. This is the standards-level answer to Mandate Record, though it covers purchases, not complaints.

• Truvera (Dock) AP2 mandate issuance

  A commercial product for issuing and verifying AP2 mandates as verifiable credentials. It is infrastructure a card issuer could use to check proof of a customer's mandate.

• Mastercard Verifiable Intent / Visa Trusted Agent Protocol

  Card network efforts to create machine-verifiable records of what a user authorized an agent to do, so issuers can base disputes on evidence. They focus on transactions, not on complaints submitted by third-party agents. The article was paywalled, so I could not confirm the details.

Checked 2026-10-28