The credential as described — a seed deriving N one-time signing keys, committed in a Merkle tree, each marked used after signing, reuse prevented — is claimed element-for-element in US10129034B2 (Amazon Technologies, priority 2016-12-23), with the clone-detection step separately claimed by Verisign in US10148441B2. The counting layer is obvious over IBM quota-share art from 1999 and 2014. One narrow composition may be clear; it is not worth a filing on its own and is not worth a company.
What survives: the market observation underneath the idea. Nobody sells action-count budgets for agents as a product, AP2 and Stripe both mandate cumulative limits and specify no enforcement, and a UK regulator is asking "what happens when the agent exceeds its instructions" with no answer on record. That is a business thesis, not a patent thesis, and it should be pursued as one.
"A credential for AI agents that is consumed by use. The agent gets a fixed number of one-time keys — say 200 — and each API request burns one. The number of keys remaining is the agent's authority; when it hits zero, the agent stops. If a key is ever used twice, that proves the credential was cloned. The spent keys form an audit trail. Target: enterprises deploying autonomous agents. We want to file a provisional patent before pitching."
Emphasis for this report, per the brief: patentability first, then market. Both are covered; the patent finding is decisive and is reported first.
The agent-authorization market has consolidated hard in the last nine months. Eight acquisitions since December 2025, including Cisco/Astrix ($400M), Cyera/Oasis (~$1B) and Palo Alto/CyberArk (~$25B).1 The category is defined and has a clearing price; a new entrant sells into an acquisition-saturated buyer.
| Player | What they ship | Bounds authority by | Relevance |
|---|---|---|---|
| Okta, Entra, Astrix, Aembit, Keycard, WorkOS | Agent identity & short-lived tokens | time + scope + revocation | Adjacent; none count uses |
| Arcade.dev ($72M raised) | OAuth brokering for tool calls; authored the MCP authz spec | scope | Category leader on the brokering half2 |
| Google AP2, Stripe ACP | Agentic payment mandates | money + time; AP2 has max_occurrences | Already mandate counting; specify no enforcement3 |
| UK Open Banking VRP | Variable recurring payment consents | count — MaximumCumulativeNumberOfPayments | Production counted authority, in a regulated market4 |
| IETF AAT draft (Tenuo) | Attenuating delegation tokens | scope + TTL + depth | Explicitly excludes single-use and budgets5 |
| IETF ACT / ARC drafts (Google, Apple, Cloudflare) | N-credit anonymous credentials, spent one at a time | count | Expired drafts; privacy-motivated; authored by the labs that could ship this6 |
Counted authority is not empty ground. It is absorbed into AP2, Stripe, Open Banking and OAuth refresh rotation. What no one does is put the counter inside the credential — and §3 shows why that specific move is not available either.
Searched: Google Patents, Justia, FreePatentsOnline, IETF datatracker, IACR ePrint, arXiv. Terms and combinations recorded in the appendix. Three patents are decisive.
US10129034B2 — "Signature delegation," Amazon Technologies. Priority 2016-12-23, granted 2018-11-13.7
| Your claim element | Where it appears in US10129034 |
|---|---|
| Seed from which N one-time signing keys derive | Claim 1: "a master seed value… a seed tree of subordinate nodes… a set of one-time-use cryptographic keys from leaf nodes" |
| Keys committed in a Merkle tree | Claim 1: public keys "in a Merkle tree, with a root node serving as a public key" |
| Verifier marks a key spent after use | Claim 2: "marking one-time-use cryptographic keys as used after generating a digital signature" |
| Reuse prevented | Claim 2: "preventing reuse of marked one-time-use cryptographic keys" |
| Remaining count = authority | Specification: delegate keeps "a first counter of keys allocated… and a second counter of keys used." Sibling US11184157 calls it a "signing budget". |
| Delegation to an agent | Claim 1: "providing the selected subordinate seed values to the one or more subordinates" |
Every structural element of the submitted credential appears in Amazon's independent claims 1 and 2. "Remaining count constitutes the scope of authority" is a characterisation of recorded state, not a structural step; an examiner treats it as non-limiting. This is a §102 anticipation, not a §103 obviousness argument, and it cannot be drafted around.
| Reference | Holder · date | What it claims | Effect on your idea |
|---|---|---|---|
| US10148441B2 | Verisign · 2014 | Detecting double-signing of a one-time key; storing the prior signature; alerting. Expressly teaches combining with a Merkle tree. | Kills clone detection |
| US7529371B2 | IBM · 2004 | "Replaceable sequenced one-time pads for detection of cloned service client" — table of sequenced entries with used/unused flags | Kills clone detection (again) |
| US9602364B2 | IBM · 2014 | Distributed quota shares to nodes, local "self-ruling," lease time, and a tapering grant formula MAX(remaining/#clients, MQS) | Kills the budget-distribution layer |
| US5946686 | IBM · 1999 | Parallel filesystem quota allocation to nodes with share revocation | Same, 27 years earlier |
| RLN (Rate-Limiting Nullifiers) | Open source, deployed | Merkle tree of commitments, N uses per epoch, spent-nullifier set, secret recovery on overuse | Whole shape, shipping today |
Written from the position of an investor or competitor trying to kill the idea. If you can't answer these in the room, you don't walk in.
The signature proves a key is authentic. Finiteness is enforced by a mutable counter on the verifier. Two verifier replicas that don't share state give the agent 2N actions, and neither replica sees a problem. A restart refills the pool. The pitch line "enforced by math, not policy" is false as stated; the honest version is "enforced by arithmetic over a consensus-maintained counter," which is a much more modest sentence and is also what every existing quota system already does.
The industry's answer to blast radius is a 60-second token, and it's stateless. The response — that a 60-second token still permits unlimited calls inside its window (a measured study found 11 requests still served after revocation8), gives no clone evidence and produces no non-repudiable record — is correct, but it's an argument for counting, which AP2 already does, not for your credential.
This is the one that ends the meeting. Contention on a budget row is bounded above by N for the credential's lifetime. A single hot row sustains ~14,500 updates/second9; a 1,000-action budget consumes 7% of one second of it, total. The Merkle tree and one-time keys buy offline verifiability — and nobody needs offline verifiability, because the verifier is always online. Chaum's 1988 founding paper on offline e-cash opens with "on-line clearing is one possible solution though a rather expensive one."10 That cost is now zero, and the entire crypto lineage this idea descends from exists to solve a problem that no longer exists.
A business survives when a buyer cannot exit, the free alternative is worse, no incumbent already holds the bound segment, and there is a forum where harm converts to money. Applied to the idea as submitted:
No regulation requires action-count budgets for agents. AP2's max_occurrences is a protocol field, not a legal duty. Demand is elective.
The free fix is a counter in the database the buyer already has. It is not worse; it is the same enforcement without a new credential format.
Arcade (brokering), Okta/Entra (identity), AP2/Stripe (payments) each own an adjacent segment, and the WIMSE working group adopted a draft in July 2026 arguing existing standards suffice.11
Yes — insurers pricing agent liability (Lloyd's, Munich Re, Beazley, AIUC) and a regulator asking the unanswered question.12 This is the one condition that holds, and it holds for the market observation, not the credential.
The observation, not the mechanism. Two flagship commerce protocols mandate cumulative action limits in prose and specify enforcement nowhere. Google explicitly deferred duplicate-order prevention as future work. A production gateway that implements budgets documents that it overshoots by one. Nobody ships "action budgets for agents" as a product. That gap is real and independently confirmed.
The credential format, the clone-detection mechanism, the budget-distribution layer, and any claim containing the words "unforgeable," "non-repudiable," or "enforced by math." Each is either anticipated or false under review.
The narrowest arguable claim, if counsel insists on filing something: escrow sub-ranges carved from a single Merkle-committed key index space, so a replica is cryptographically unable to exceed its allocation, plus a recited cross-replica reconciliation step. Caveat: Amazon's same patent already delegates disjoint seed-tree subtrees to multiple subordinates sized by predicted volume. Only the reconciliation step is arguably clear, and it does not justify the filing cost.
Recommended repositioning: drop the patent. Build the counter as a product — a pre-install gate that sits in the request path and draws from a funded third-party-risk budget — and lead with the regulator's unanswered question rather than with cryptography.
The ten questions this report predicts you will be asked, with the answer that survives the evidence above. Memorise the first three.
Nobody ships action-count budgets for agents as a product. Counting exists inside AP2, Stripe ACP and Open Banking VRP as protocol fields — mandated but unenforced. We enforce it.
A 60-second token permits unlimited calls inside the window. A measured study found 11 requests still served after revocation. Time bounds duration; only a count bounds multiplicity. They're orthogonal, and everyone has the first one.
Yes — and that's the point. The value is not the counter, it's being the counter AP2 and Stripe require and nobody has built correctly across distributed calls. We're selling the enforcement, not the primitive.
We ran prior-art review before filing and found Amazon holds the mechanism. We didn't file. Our defensibility is the ledger and the integrations, not IP.
They might add a counter. They can't add the cross-platform history, and the WIMSE draft they backed argues existing standards suffice — they've publicly committed to the other side of this.
Third-party vendor risk. It's an existing compliance line item with an owner, unlike "ecosystem data," which has neither.
A documented daemon ran 20 hours, 5,501 API calls, every one authenticated, authorised and in scope. It sails through a fresh token, a policy engine and a guardrail. Only a count stops a legitimate agent doing legitimate things too many times.
HM Treasury's July 2026 consultation asks "what happens when the agent exceeds its instructions" and sets no standard. That's our question, asked by a government, unanswered.
A registry or platform shipping its own counter as a feature. Our defence is speed to standards and owning the audit history, which is a data-gravity moat rather than a technical one.
Because we already did the diligence that found the Amazon patent before an investor did, and we changed course on the evidence. That's the operating discipline you're funding.
Method. AI-driven search across patent databases, standards bodies, preprint servers and funding trackers — 214 sources examined, 31 cited. Every finding verified by hand against the primary document before inclusion. Two independent hostile reviews (one engineering, one patent-examiner framing) run against the idea and against each other's conclusions.
Limits. This is a prior-art landscape, not a freedom-to-operate opinion. It does not cover unpublished applications inside their 18-month window, foreign filings, or continuations still pending. Patent claim text was read through a summarising layer and should be verified verbatim by counsel before reliance. Market figures are from press releases and trade press as cited. Nothing here is legal advice.
Every report follows this structure: landscape, prior art with element mapping, hostile review, four-condition test, what survives, and — on the Premium package — the investor question sheet with prepared answers. 24–72 hour turnaround. Every source linked. If the answer is "don't," you'll know why, and you'll know what to build instead.