The Agentic Web Needs Consent, Not Just Tool Access

How FairPath is testing privacy-preserving AI agents in a consequential property-tax workflow.

The agentic web is arriving quickly. Instead of only answering questions, AI systems can now discover tools, request structured information, and complete multi-step tasks across services.

That is exciting. It is also incomplete.

The central question is not simply whether an agent can call a tool. It is whether the tool, the agent, and the product can preserve consent, minimize data, and keep consequential decisions with the person they affect.

Property tax is a useful test. A homeowner may need help understanding county requirements, organizing evidence, or checking whether a property record is available. The workflow can involve an address, assessment values, deadlines, and decisions with real financial consequences. “Give the agent everything and hope it behaves” is not an acceptable architecture.

A deliberately narrow agent surface

FairPath's first live Model Context Protocol (MCP) surface exposes three read-only capabilities:

• explain public property-tax argument lanes;
• return county-specific filing requirements; and
• check a property only after explicit address consent.

It cannot file with a county. It cannot create a checkout session. It cannot charge a homeowner, publish content, send a message, or make the homeowner's decision.

Those are not temporary omissions. They are part of the trust model.

The address does not need to go to the model

Our protected Claude canary tested a simple privacy principle: the model should receive only the information it actually needs.

Claude received an opaque address token plus the consent-bound tool contract. It had to preserve the token, the consent flag, the consent timestamp, and the opaque consent-event identifier exactly. The real authorized address was substituted locally only when FairPath called its own MCP endpoint.

After the lookup, FairPath returned a minimized status result to Claude—not the address, property identifier, county identifier, assessed value, or raw property payload. Claude could finish the interaction without ever receiving the homeowner's address.

This is a small architectural choice with a large implication: agentic products do not have to choose between useful tool access and data minimization.

Identity, consent, and audit evidence

The canary also used a disposable, least-privilege Claude identity. It was authorized only for the property-check scope and tool, operated under a bounded rate policy, and was revoked after the run.

FairPath verified linked records for:

• the agent identity;
• the agent session;
• the explicit address consent;
• the tool-call decision;
• the output hash;
• the property-context hash; and
• execution latency.

The response contained none of the fields the agent surface prohibits: owner data, payment data, raw prompts, or raw county records.

The protected canary passed its functional and privacy checks. Our first bounded production readout then reconciled five agent calls: four authorized executions completed successfully, one policy denial behaved as expected, and no errors were recorded. Identity, consent, sensitive audit, latency, and platform-log reconciliation were complete. Observed P95 latency was 1,553 milliseconds against a provisional 2,000-millisecond target. This remains an early sample, not a long-term service-level claim.

Human agency remains the boundary

FairPath helps homeowners understand their records and organize evidence. The homeowner decides whether to act and submits any county filing themselves.

That boundary matters. An agent can reduce confusion and administrative burden without silently becoming the decision-maker, filer, purchaser, or legal or tax advisor.

What comes next

Claude is FairPath's incumbent model provider and the first completed baseline. The same governed interface is being prepared for OpenAI and Gemini canaries, each with a separate identity, tool allowlist, consent tests, redaction tests, audit reconciliation, and credential lifecycle.

Thinking Machines' Tinker is also interesting, but for a different reason: it may become a research environment for testing specialized models and training approaches. We are keeping that work separate from the production agent gate.

The long-term opportunity is larger than property tax. The same pattern can apply wherever agents touch consequential consumer workflows:

1. give the agent the smallest useful tool surface;
2. bind sensitive actions to explicit, fresh consent;
3. keep private identifiers out of the model when a token will do;
4. create durable evidence of what was allowed and why;
5. revoke access cleanly; and
6. preserve the human's authority over consequential actions.

That is the agentic web we want to help build: useful, interoperable, and accountable by design.

FairPath prepares property-tax argument records and evidence packets. The homeowner chooses whether to file and submits any county filing themselves. This is county-specific filing guidance, not legal or tax advice.

Explore FairPath’s public agent interfaces: agent-tools.json, ai-agents.txt, and fairpath.app.