Ratify Protocol

Insurance voice AI

State insurance regulators require that AI acting on behalf of licensed agents stays within the agent's authorized scope. Today, agencies prove this with call logs and attestations — documents that can be questioned after the fact. With Ratify, before your platform places the call, it checks a DelegationCert the licensed agent signed: permitted to discuss auto and home quotes, not permitted to bind coverage or collect payment. If the cert is missing or expired, the call doesn't go out. If a regulator or the agency's E&O insurer (professional liability coverage) later asks 'show me the authorization record for this call,' the cert chain is the answer — signed by the agent's key before the call happened, not written by the same system that placed it.

Financial services — advice vs. information

Regulations like MiFID II draw a hard line between 'providing fund information' and 'giving personalized investment advice.' An AI that crosses that line creates regulatory exposure. Ratify lets you scope a cert to information-only, and your platform checks that boundary before each session. It doesn't make your platform MiFID II compliant by itself — compliance requires much more — but it gives your compliance team a signed, machine-readable record of what scope the AI was authorized to operate within on each call.

Healthcare intake

An AI calling patients before appointments to collect symptoms and insurance information. Your platform issues a DelegationCert scoped to intake questions only — no diagnoses, no clinical guidance. Before each call, your system checks the cert. When your compliance team or a HIPAA auditor reviews a flagged call, the cert is the pre-call authorization record. It doesn't replace your HIPAA compliance program, but it adds a layer of cryptographic evidence that the AI was constrained before it acted.

Sales AI — what it can and can't commit to

An AI SDR makes outbound calls on behalf of sales reps. The rep's signed cert says: can qualify leads and book demo calls, cannot discuss pricing or make commitments. Your platform checks this before dialing. If a prospect later disputes what the AI promised, your cert shows what the AI was authorized to say — before the call started, not after the incident.

Delivery drones

Before each flight, the warehouse operator issues a DelegationCert to the drone: authorized delivery zone (geo-circle), altitude ceiling, speed limit, maximum payload. Your flight control software calls verify() before processing each waypoint command. If the requested waypoint is outside the cert's geo-circle — wind drift, GPS error, rerouting — verify() returns false. What your software does with that is your decision: hover, return-to-base, alert the operator. The cert is the record that the constraint existed before the flight, not a log written by the same system that flew the drone.

Factory robots and assembly lines

A robotic arm carries a cert: authorized for zone A3, part weight under 15kg, shift hours only. Before executing each movement command, your control software checks the cert's zone and time constraints against the target coordinates and current time. If a command would move the arm into zone B4 — which isn't in the cert — verify() returns false and the command is rejected before it reaches the actuator. After a workplace incident, your insurer and safety regulator can see the cert that defined the robot's authorized operating envelope — signed by the plant operator, predating the incident.

Autonomous vehicles — delegated access

A vehicle owner signs a DelegationCert for a specific use: authorized within a geo-boundary, speed ceiling, time window. The vehicle's onboard verifier checks the cert before executing navigation commands. This doesn't require cloud connectivity — the cert travels with the vehicle. No automaker is shipping Ratify today, but as shared fleets and AI chauffeur services arrive, 'who authorized this vehicle to be here, doing this, right now' will need a better answer than a booking record.

Industrial control systems

A grid operator opens a maintenance window: certs issued to specific actuators, authorized to switch specific breakers, during the 02:00–04:00 window only. At 04:01, the certs are expired and verify() returns false for any switching command. The cert chain is the authorization record for the maintenance window — signed by the operator before the window opened, not reconstructed from system logs after the fact. Industrial control vendors building on Ratify get a standardized authorization layer that their enterprise customers' security teams can audit.

AI notetakers

Companies like Otter.ai, Fathom, and Fireflies send bots to meetings. Enterprise IT teams are increasingly blocking these because there's no standard way to verify who authorized the bot or what it's allowed to do. When you integrate Ratify into your notetaker platform, each bot joins with a DelegationCert: signed by the meeting host, scoped to observe and transcribe only, expires when the meeting ends. Your Ratify Meetings integration checks the cert via webhook before the bot gains access. Enterprises that manage their own Ratify deployment can set policy: only bots with valid certs from authorized staff get in.

AI in client-facing sales calls

A sales AI joins calls to assist reps. The account executive signs a cert: observe and take notes, don't speak or make commitments. When the call recording is later reviewed — by the client, by a compliance team, by legal — the cert shows what the AI was authorized to do, pre-call, in a form that can't be edited after the fact. This isn't widely required today. It will be.

Regulated industry calls

Legal depositions, medical consultations, and financial advisory sessions increasingly involve AI tools. In many jurisdictions, AI participation must be disclosed. A Ratify cert is a stronger disclosure than a consent banner: it's signed, timestamped, scoped, and attached to the session record. Your platform builds the compliance story once; every session inherits it.

Production data access

An AI coding assistant or automation agent needs read access to production analytics. The developer signs a cert: read-only, specific table prefix, 1-hour expiry. Your API gateway — with the Ratify verifier integrated — checks the cert before passing the query through. Writes and out-of-scope table access return 403. The gate is at the API layer, not inside the agent's code where it can be bypassed or manipulated.

Financial operations

An AI agent handles invoicing: authorized to query balances and create draft invoices, not authorized to initiate transfers. Your payment API gateway checks the cert scope. If the agent is compromised — through a prompt injection attack or a bad model output — and attempts a transfer, the cert scope rejects it before it touches the payment rail. The human never authorized transfers; the cert proves it.

Agent-to-agent delegation

An orchestrator agent decomposes a task and delegates subtasks to specialized sub-agents. Each delegation is a cert: the sub-agent is authorized for exactly the tools its subtask needs, nothing more. When the sub-agent makes an API call, your gateway checks the cert chain — orchestrator authorized by the human, sub-agent authorized by the orchestrator, scope constrained at each level. Prompt injection that tricks the sub-agent into requesting out-of-scope access hits the cert boundary at the API layer.