Consent Is the Wedge

Picture two agents meeting for the first time. One belongs to you. The other belongs to a stranger — a wealth advisor three ZIP codes away, a carrier, a clinic, another person entirely. The stranger’s agent wants something: a slice of what your agent knows about you. In the old world, that request is answered by a password, a permission screen you skimmed, and a shrug. In the world we are building, it is answered by a receipt— signed, chained to the one before it, impossible to quietly erase.

That receipt is a small thing. It is also, we have come to believe, the whole game.

For a year the industry has argued about whether “consent-first” is a cost — a tax you pay to lawyers and auditors before you get to ship the fun part. This week, heads-down in the code, we watched the argument invert. The consent layer is not the tax. It is the wedge: the single mechanism that a federal agency and a local marketplace both require, for the same reason, and that almost nobody else can offer. Build it once, honestly, and you have simultaneously satisfied the most demanding buyer on Earth and unlocked the most human one.

Two rooms, one lock

Walk into the first room. It is full of people who evaluate systems for the U.S. government. They do not care about your demo. They care about a specific, ancient question: when someone touched this record, can you prove it — and can you prove no one has tampered with the proof?The controls have dry names — audit protection, non-repudiation, key management, phishing-resistant identity — and a company cannot talk its way past them. You either have them in the code or you do not.

Now walk into the second room. It is a neighborhood. Someone is looking for an insurance agent, a financial advisor, a specialist who will actually pick up the phone. Their agent needs to reach a stranger’s agent and hand over exactly enough — no more — to get help. What makes that safe? The same thing the government asked for: a provable, tamper-evident, revocable record of precisely what was shared, and consent that can be withdrawn the instant it is misused.

The most regulated buyer on Earth and the most human one are asking for the identical primitive. That is not a coincidence. That is a wedge. Most companies pick one room. Serve the agencies and you build a fortress no human wants to live in. Serve the neighborhood and you build something delightful that no auditor will ever bless. Our bet is that if you build the lockcorrectly — once, at the protocol layer — it opens both doors.

A receipt for every access

The oldest honest complaint about consent logs is that they are just… a table. Rows in a database. And a row in a database can be edited, or quietly deleted, by anyone with the keys — including us. A log you can silently alter is not evidence. It is theater.

So this week we gave the consent ledger a spine. Every consent event can now be mirrored into an append-only chain, where each receipt is hashed together with the one before it and then signed. Change one old receipt and the chain breaks at exactly that link. Drop one and the sequence tells on itself. It is the difference between a diary and a ledger.

In the government’s language this is audit protection and non-repudiation. In a person’s language it is simpler: nobody — not even 🤫 hussh — can rewrite the story of who touched your information.

Two honest caveats, because this is a build-in-the-open note and not a press release. First, it ships behind a kill-switch, off by default— the control is real in the code, proven by tests, but not yet turned on in production. Second, it currently runs as a mirror alongside the live ledger rather than inside the same database transaction, so a crash in the gap leaves a detectable gap, not a silent loss. We wrote that limitation into the code where the next engineer will find it. We would rather tell you the shape of the unfinished edge than pretend it is smooth.

Keys in a vault, not a variable

A signed receipt makes a promise: this key, and only this key, could have signed it.That promise is worth exactly as much as the custody of the key. For most of software’s history, the answer to “where is the key?” has been an embarrassed “…in an environment variable.” Plaintext. Sitting there.

The second thing we built this week moves the signing and encryption keys into a hardware-backed vault, so the key that proves your receipts lives wrapped, rotated by the platform rather than by hand, and never sitting in the open. It is the difference between a promise and a promise you can keep. Like the receipt chain, it is real, tested, and deliberately off until we choose to turn it on. We are building ahead of the moment we need it, not scrambling behind it.

The most expensive word we did not write

The strongest way to prove a human is present is a physical security key — the little device you tap. It is phishing-resistant in a way a text-message code will never be. We built the ceremony that verifies it. And then we did something that tells you more about this company than any of the cryptography: we made the code refuse to overstate the result.

A hardware key earns the label AAL3-candidate— not AAL3 — until its attestation is checked against the manufacturer’s metadata registry. AAL3 is the top tier of identity assurance. It would have been one word cheaper to simply claim it. We did not, because it would not have been true yet. That single word — candidate— is the whole philosophy in miniature.

The card at the front door

All of that is the lock. The wedge only pays off when the door actually opens onto the neighborhood — when your agent can be found and reachedby the local humans and agents who have what you need. So the last plank we laid this week is a standard agent card at the front door: a small, public description an agent publishes so another agent can discover it, read what it offers, and know exactly how to ask — the same open rail the broader agent ecosystem is standardizing on.

The quiet magic is that the card and the receipt are the same story from two ends. The card says here is what I can do and how to ask me. The receipt says here is the proof of what you were actually given.An agent that carries both can be listed in a marketplace and trusted by an auditor — because the thing that makes it safe to be discovered is the thing that makes it safe to be regulated. This, too, sits behind a flag today: the front door is built, not yet unlocked.

In pursuit

You will not find us claiming a certification we do not hold. Search our code and you will find, over and over, the phrase in pursuit. It is written into the compliance pages, the identity classifier, the strategy documents. It means: we are building to the bar, in the open, and we will call it earned the day an independent assessor says so — and not one day before.

This is not modesty. It is strategy. The buyers we most want have a finely tuned instrument for detecting a company that oversells its security posture, and it goes off on day one. The single most valuable thing we can bring into that room is a codebase that has never once lied about what it is. What we have not earned, stated plainly: no federal authorization, no independent assessment engaged, no defense impact-level boundary. The controls are built to the bar. The attestation is ahead of us.

A receipt in your hand

So: is consent a tax? Only if you build it grudgingly, as the smallest thing that keeps the lawyers quiet. Build it as the product— a receipt for every access, a key in a vault, an identity honestly labeled, a front door that carries its own proof — and it stops being the cost of doing business. It becomes the reason your agent can be trusted anywhere: in a federal boundary and on a neighborhood street, by a machine that audits and by a human who just wants help.

That is what own your AI, own your data, own your compute has to mean in practice. Not a slogan. A receipt in your hand, signed with a key that never leaves the vault, for every single thing your agent ever does on your behalf.

We are not done. Most of what you just read waits behind a switch we have not flipped, on a road whose certificates we have not yet earned. But the wedge is real, it is in the code, and this week it got sharper.

Meet 🤫 Agent One at /one, and see our honest compliance posture at /one/compliance.