Daon, an identity and biometrics vendor based in Fairfax, Virginia, announced this week that it has completed what it calls the first commercially patented three-layer authorization stack for autonomous AI agents. The new patent, the third in the series, authorizes or denies each sensitive agent action individually, at the moment the agent attempts it, rather than relying on broad permissions granted once at login. The framing matters because most enterprise identity systems still work the other way around. As the announcement puts it, if an AI agent makes a payment, changes a user's identity credentials, or executes a trade, most enterprise identity infrastructure has no mechanism to stop it unless a human intervenes before the session even starts. Daon's approach splits agent behavior into two tiers: lower-risk actions like retrieving account data or drafting a transaction for review can proceed under standing permissions, while irreversible or high-stakes actions require a fresh, narrowly scoped authorization with a short validity window and rate limits designed to block bulk execution without a human checkpoint. The timing lines up with survey data the company cites: a Cloud Security Alliance study commissioned by Aembit in January 2026 found that nearly three-quarters of organizations give AI agents more access than their tasks actually require. That's the structural problem this patent is aimed at — not agents behaving maliciously, but agents holding standing privileges wide enough that a single prompt injection, bad instruction, or misconfigured task can trigger a consequential action nobody explicitly approved in the moment. It's worth being clear-eyed about what a patent announcement actually proves. It documents a specific technical mechanism now legally owned by one vendor, not a market-wide standard. Other players — CrowdStrike with its Continuous Identity model, Microsoft with Entra Agent ID, the Cloud Security Alliance with its Agentic Trust Framework — are converging on similar per-action, standing-privilege-free designs using different plumbing, including SPIFFE and Shared Signals Framework primitives. What's notable isn't that one company solved agent authorization; it's that the direction of travel across the field is now the same: authorization decisions are moving from session start to the instant of action, and vendors are racing to make that the default rather than the exception. The open question is interoperability. A per-action authorization gate that only works inside one vendor's stack doesn't help an agent that hops between a CRM, a payments API, and a third-party MCP server in the same task. Until these action-level checks can be verified across vendor boundaries without prior coordination, each announcement — however real the underlying engineering — solves the problem for one fenced garden at a time.