Loop is a protocol that provides privacy-preserving human-in-the-loop approvals for AI agents. It enables unphishable, auditable consent flows for agentic AI systems operating in enterprise environments.

How does Loop prevent phishing attacks?

Loop approvals are audience-bound (tied to a specific agent's DID) and action-bound (cryptographically hashed to specific actions). Combined with DIDComm authenticated messaging and out-of-band delivery through the user's device, phishing becomes mathematically impossible.

What is a Loop Proof?

A Loop Proof is a short-lived credential (≤5 minute TTL) that proves a human was present and consented to a specific action. It includes biometric attestation from device secure hardware, audience binding to the requesting agent, and action binding via cryptographic hash.

What standards does Loop use?

Loop is built on established W3C and DIF standards: ZCAP-LD for capability delegation, W3C DIDs for identity, Verifiable Credentials 2.0 for credential format, DIDComm v2 for secure transport, and OpenID4VP for presentation exchange.

Does Loop store biometric data?

No. Biometric templates never leave the device's secure hardware (Secure Enclave/TEE). Loop Wallet uses platform biometric APIs that only provide boolean success/failure signals. The biometric data itself is never exposed to applications.

What is a Loop Receipt?

A Receipt is a durable evidence record that captures what was consented to, what action was executed, and any third-party attestations. Receipts are tamper-evident and can be anchored to transparency logs for audit purposes.

What industries can use Loop?

Loop is designed for any industry deploying AI agents with high-stakes actions: finance (expense approvals, payments), DevOps (production deployments), healthcare (HIPAA-compliant record access), enterprise (customer service, data access), and more.

Technical Whitepaper - Loop Protocol Specification