In early 2024, a finance worker at engineering firm Arup joined what looked like a routine video call with his CFO and several colleagues. Every person on that call, except him, was an AI-generated deepfake. He transferred $25.6 million before realising anything was wrong. Nobody hacked Arup's systems or stole a password. The attackers exploited one assumption: that the person on screen is real.
Deepfake fraud losses in North America exceeded $200 million in Q1 2025 alone. Meanwhile, AI agents are signing contracts, approving deployments, and executing workflows without any mechanism to prove a human said yes. Enterprise security was built to verify credentials. It was never built to verify humanity.
That gap is what World ID 4.0 targets. Unveiled at Sam Altman's Lift Off event in San Francisco last week, it arrives with four enterprise partners: Docusign, Okta, Vercel, and Zoom. Crucially, each is solving a different version of the problem.
"We are heading to a world where there's going to be more stuff generated by AI than by humans," Altman told attendees. "World ID is designed to solve that at the root."
Docusign and World ID: Proving a Human Actually Signed That Contract
When an AI agent completes a contract on someone's behalf, who is accountable? Most businesses currently have no clean answer, and the legal risk is growing fast.
Docusign already works with identity verification partners Onfido and Socure to confirm who a signer is. But World ID answers a different question: not who signed, but whether the signer was human at all. As AI agents become capable of navigating agreement workflows from start to finish, that distinction is becoming a serious liability gap. The two verification layers sit alongside each other in the signing flow, so together they create a chain of accountability that neither provides alone.
Vercel and Okta: Building Human Accountability Into AI Agent Workflows
For developers shipping agentic applications, Vercel is embedding a human-in-the-loop checkpoint into its open-source Workflow SDK. A single npm package lets developers require cryptographic proof of human authorisation before any workflow step proceeds. Every check is then logged in the execution record. The result is a verifiable audit trail for the moments that matter most: a production deployment, a large transaction, a sensitive data access request. In short, any action where "the agent did it" is not an acceptable answer after the fact.
