The audit trail problem here is more nuanced than most teams realize until they're mid-SOC2 audit and the auditor asks "can you show me every action your AI sys

The audit trail problem here is more nuanced than most teams realize until they're mid-SOC2 audit and the auditor asks "can you show me every action your AI system took on behalf of a user and who approved it?" WebAuthn as the signing primitive is clever because the origin binding gives you some protection against replays, though I'd be curious how you handle the case where the agent is running server-side and the WebAuthn assertion has to be transported back — that round-trip introduces timing issues in fast-moving tool chains. What compliance frameworks are you seeing the most demand from? My hunch is it's less SOC2 Type II and more the FedRAMP crowd and financial services teams who are starting to gate AI agent deployments on exactly this kind of provability. Are you seeing that or is it more developer-driven demand right now?