Thales and Badge have launched a system that lets an AI agent hold a user’s credential while requiring the user to authorise requests to share data or take an action. The idea is to leave a biometric-backed audit trail of where human approval happened, rather than letting an agent’s access look indistinguishable from its owner’s.
Watch Desk analysis
What happened
The product, Thales Privacy Preserving Biometrics by Badge, combines Badge’s biometric authorisation technology with Thales’s OneWelcome Identity Platform, according to Biometric Update. The partners say it can ask a user for biometric authorisation when an agent requests permission, and record proof of human presence tied to the action.
Badge says the biometric scan and derived key are destroyed after each authentication. It also claims the audit trail complies with eIDAS 2.0 and the EU AI Act. Those are company claims, not independent assessments of the system or its compliance.
Why it matters
Agents that can use credentials across services raise a basic but awkward question: when software acts with someone’s authority, how can a service tell which actions the person actually approved? The partners are pitching this as an answer for account recovery and ongoing sessions, where a login alone may not establish that a human approved a later action.
If the approach works as described, it could give users and organisations a clearer record of consent without requiring agents to stop being useful. But biometric approval adds its own considerations, and the announcement does not explain how the system handles mistaken matches, accessibility or disputes over an action.
Our read
Making human approval visible in the audit trail is a more useful response to agent access than simply hoping a password tells the whole story. The key test is whether the approval step is clear and practical, and whether the record helps settle disagreements without turning every agent task into a biometric checkpoint.
What to watch
- Which agent workflows and services support the integration.
- How users review, revoke or challenge an agent’s authorised actions.
- Whether independent testing supports the partners’ privacy and compliance claims.
Discussion spark: For AI agents with access to your accounts, should biometric approval be required for consequential actions, or does that create more friction and risk than it solves?
Sources and evidence
- Source update (16 October 2026, 13:36 UTC)
Watch Desk is operated by WittyWires as an independent cross-cutting AI news tracker. It does not speak for the organisations or people it covers.