Public beta · the BotShield app is live on the web.  →
Console
Console
Products
Verified AccountsTrusted AgentsBotShield ActionsBotShield Gates
For your users
BotShield IDAgents Ask™
For developers
Console
Customers
Couchtour
Company
AboutInvestorsContactNewsroom
Agents Ask™

SMS codes are expensive. Agents Ask is built on a passkey.

You pay a carrier for every code you send — the retries, the ones that never arrive, the international ones, and the floods you never sent. An ask is not a message. Nothing is sent, so there is nothing to meter but the answer.

Explore the consoleTalk to a person  →
FIDO Alliance memberFIDO Alliance member · every product stands on a passkey
The BotShield app — Agents Ask: three requests waiting for a person
The same minute, both halves

Where the code used to go.

Your support desk is already having this conversation. The only question is what happens at the moment it has to be sure — six digits read out loud, or an ask that lands on the phone in their hand.

Any support desk running agents — human or AI — is already the buyer: the code is replaceable precisely because the company already has an agent in the conversation.

Northline support chat — the room where the code used to go: verify in BotShield with your passkey
The BotShield app — the ask: Northline, change your plan? From Unlimited 5G to Unlimited 5G Plus, effective your next bill — approve with passkey, or decline
The chat

“Before I make the change I need to confirm it’s really you.”

Every company says this sentence. Today the next thing that happens is a text message — which proves a phone received something, and can be read aloud to whoever is already on the call.

What lands instead

The act itself, on their device.

Not a number to repeat — the change they asked for, written out, with a yes and a no. Northline never sees the answer, only that one was given.

No code to type and nothing to forward, because there is nothing to forward.

Every ask ends one of three ways

And the one that sells it is No.

Approved is what a demo shows you. Declined is what you are actually buying — the moment an agent asks for something the person did not want, and the answer stops it dead with a record of who said so.

Approved

They said yes.

The act runs, and what goes back to the company is the answer — not the person.

The BotShield app — an ask approved, and what went back: a Proof of Resolution, never your identity
Declined

The attack ends here.

No means the act never happens. Nothing was taken, nothing leaked, and there is a record of a refusal.

The BotShield app — an ask declined: the attack ends here
Expired

Nothing happened, on purpose.

Silence is not consent. An ask that times out closes — the default is always no.

The BotShield app — an ask expired: nothing happened, on purpose
The MCP tools

Five tools. Your agent calls them; we notarize.

Agents Ask is an MCP server. Your agent calls these five and nothing else — there is no sixth tool that skips the person.

propose_resolution

Puts the act in front of the person and waits.

bind_session

Ties this agent’s session to the person who linked it.

check_binding

Asks whether that link still stands before it tries.

check_resolution_status

Reads the answer — waiting, confirmed, denied, expired.

cancel_resolution

Withdraws the ask. Nothing happened.

Every one of them notarizes. The act arrives as a Request Card, and what comes back is a signed Proof of Resolution — the company’s record, not ours.

Agents Ask FAQ

How do you approve an AI agent’s action before it happens?
The agent calls propose_resolution and waits. The act arrives in the person’s BotShield app as a Request Card — what, from whom, what it costs, when it takes effect — and they answer with a passkey. A signed Proof of Resolution goes back to the company before anything runs.
Can an AI agent spend money on my behalf safely?
On the acts you say yes to, one at a time. The agent never holds your passkey, so it cannot answer for you; the yes comes from your own device and is single-use for that one act. Decline, or say nothing, and nothing is spent.
What stops an agent acting without permission?
Your code does, by requiring the Proof of Resolution before it executes. The five tools can bind, propose, check and cancel; none of them can say yes. An ask that is declined or expires closes — the default is always no.
How is an agent’s approval proven afterwards?
The Proof of Resolution is a signed record that a real person answered this act at this moment. It names the act, the answer and the time — never the person — and it is the company’s record, verifiable against BotShield’s public keys.
What happens if nobody answers the request?
It expires. Silence is not consent: an ask that times out closes as a no, the agent is told, and nothing happened. There is a record of the expiry, on purpose.
Which agent frameworks does it work with?
Any that can call an MCP server — Agents Ask is one. A support desk’s agent, a billing agent, an Agentforce-class agent, your own integration: point it at the five tools. A person’s own assistant is not the buyer; the company that already has an agent in the conversation is.

Stop sending codes to prove it’s them.

Ask them instead — on the device they are already holding, with an answer you can keep.

Talk to a person  →Explore the console