The three levels of the Human Seal

Level 1 Gated

In enforce mode, every world-affecting action is held for a human approval before it runs, and each decision is logged. A new agent's gate starts in shadow mode, which records and holds nothing until a person switches it to enforce.

Requirements

• An explicit registry of the world-affecting action types that require the gate.
• Fail-closed: a timeout, an error, or an absent human is a block, never an implicit approval.
• The approver is a real, authenticated identity, distinct from the AI and from the requester.
• Every approve, refuse, override and stop is recorded.

Level 2 Signed

Each approval produces a Human Seal: a signed, tamper-evident receipt, bound to the approver and the exact action, verifiable offline.

Adds to Level 1

• An Ed25519 signature over the canonical receipt (RFC 8032).
• A sha256 content hash binding the exact action approved, so it cannot be swapped afterward.
• The approver identity and role, the decision, and the time, all signed.
• Offline verifiability against a did:web trust root, with no call back to the issuer.
• The decision-conditions evidence (what the approver saw, and the time taken), so oversight quality is provable, not assumed.

Level 3 Assured

A present-human, risk-scaled step-up, with a second-approver check for the highest-risk actions.

Adds to Level 2

• Evidence that the approver is a present human, not a delegated agent (a hardware or platform authenticator step-up bound to the session).
• Dual control: two distinct, authorized approvers for the highest-risk class.
• Risk-scaled friction, applied where it changes the outcome.

Level 3 addresses the frontier problem, proving a real human is present at the moment of approval. Level 3 is the frontier, and it is where our present-human work lives. It is not built: no system holds it today, and the present-human step-up is still in design.

How verification works

Conformance is not self-declared: today we check it ourselves, against the published test vectors. A system points us at its Human Seal endpoint; we verify real receipts and, for higher levels, review the gate behaviour and the decision-conditions evidence. That is not yet independent. Independent certification and continuous re-audit are planned, so the mark can stay meaningful. The only system listed today is FLOCORE, the reference implementation, which also wrote the standard. See what is and is not built.