Multi-Party Approvals for Risky Autonomous Workflows
SignerSet brings policy-based, multi-party approval to consequential AI actions.
Choose the actions. Choose the approvers. Let autonomous workflows handle the rest.
How SignerSet works
Every protected application has a verifier- either built into the application or provided by a proxy.
For each action, the verifier applies the policy you configure: whether approval is required, how many signatures are needed, and which participants are authorized to provide them.
Participants can be humans, agents, or software.
For increased security, separate the participants into separate user accounts or machines.
Connect the applications your agents can use
SignerSet supports dozens of MCP servers today, with more integrations being added regularly by us and by the community. You can create your own with a generator tool.
Choose the actions that require approval
Decide which operations can run automatically and which must collect signatures before execution.
Trusted application plugins from MCP server publishers describe the available actions and make approval policies straightforward to configure.
Assign authorized participants
Create signing keys for agents and humans. These are the “Signers.”
Assign each participant the role of Proposer (action initiator), Maintainer (approver), or both. Then define which participants—or groups of participants—may approve each governed action. These are the “Sets.”
Run autonomously, more securely
Routine actions proceed without approvals.
For high impact actions, SignerSet collects the required signatures, verifies the policy, and releases the exact action that was approved.
For complete autonomy, make review agents the approvers.
Why a new control layer is necessary
AI agents are becoming operators
Agents can now deploy code, modify infrastructure, query databases, manage repositories, purchase services, and act across critical business systems.
The consequences are no longer hypothetical. AI coding agents have deleted production data despite explicit instructions not to act. In controlled safety evaluations, advanced models have worked around shutdown controls, concealed their actions, and reasoned toward objectives that conflicted with operator intent.
These failures do not require malicious intent. A mistaken assumption, an ambiguous instruction, compromised context, or an over-permissioned credential can be enough.
Limits of Current Authorizations
Most access controls were designed to answer a simpler question:
Does this identity have permission to use this system?
Autonomous workflows require another question:
Is this exact action authorized to execute right now?
Without that additional decision point, teams are forced to choose between giving agents excessive authority and preventing them from doing useful work.
SignerSet adds that decision point.
Before a high-impact action executes, the application can require approval from multiple authorized participants—for example, an independent agent, a human operator, or both.
Even without a human in the loop, an independent agent creates a second decision boundary while allowing the workflow to maintain autonomy. It can review the exact proposed action, identify dangerous parameters or incorrect assumptions, and withhold the signature required for execution.
Policies can evaluate both the command and its exact parameters. Deleting a test database might require one signature; deleting a production database might require three. Application plugins identify sensitive operations, while cryptographic signatures record exactly what was approved, by whom, and under which policy.
More than isolation
Sandboxes contain agents. SignerSet authorizes actions.
Sandboxes, permissions, policy engines, monitoring, and human confirmation interfaces all have important roles in agent security. They limit where an agent can operate, what it can access, and how its activity is observed.
SignerSet adds a different control: portable, cryptographically verifiable authorization for the exact action before it executes.
It does not replace the security stack. It gives existing agent products and controls a common way to require multiple approvals, verify them deterministically, and prove which action was authorized.
Open source and neutrally governed
Built on an open project
SignerSet is built on MPAS—Multi-Party Action Security.
SignerSet originated the MPAS protocol and reference implementation, then contributed them to OMA3 so the standard would be governed neutrally rather than controlled by a single vendor.
MPAS is now an approved OMA3 open-source project developed through OMA3’s industry standards process. Its specifications, SDK, reference implementation, conformance model, and application registry are developed in OMA3-owned repositories.
SignerSet remains a leading contributor to the MPAS SDK and offers it as a managed cloud service, backed by the team that built the protocol — a natural place to start for enterprises that want help integrating MPAS.
Give agents room to act—with proof that the right controls were followed
Start with one consequential action that should never depend on a single agent or credential.