Why identity is not the same as intent

Verification stacks have become impressively good at answering one question: who is this? Biometrics, device signals, credential issuers and session checks all sharpen that answer. None of them, on their own, answers the question that matters most when money, agreements or records are about to move — did this person mean to do this specific thing?

Three different questions

• Identity confirms who is present — a person, a credential, a device.
• Permission defines what is allowed — the boundaries around an action.
• Intent is the evidence that a person authorized this particular action, at this moment, understanding what it would do.

In most products these three collapse into a single "verified" flag. That is convenient to build and easy to reason about, right up to the moment someone disputes an outcome and the organization needs to say more than "our systems let it through."

Why agents make the gap visible

When a person acts directly, intent is usually implicit in the act itself: they typed the amount, pressed the button, signed the page. When an AI agent acts on someone's behalf, that implicit link disappears. The agent may hold valid credentials, operate inside configured permissions, and still carry out something the person never actually confirmed for that occasion.

The problem is not that agents are new. It is that they separate the actor from the authorizer, and most of the verification we built assumes those are the same party.

What proof of intent adds

A proof of intent is a record that a specific authorization took place: the action that was put to the person, the confirmation they gave, the rules that applied, and independent attestation that the exchange happened as described. It sits alongside identity and permission rather than replacing either — a third column in the same table.

Notaries have verified what's real for centuries. We're bringing that same trusted concept to the digital world.

A practical test

Ask what your current stack would produce if a customer said "I never authorized that." Identity answers who held the credential. Permission answers what was allowed. Intent answers what the person actually agreed to — and whether anyone besides your own logs can confirm it.

ReLeaf Financial's Proof of Intent™ work is designed for that third answer: verification that is produced at the moment of the decision, in a form a relying system can keep and examine later.