# E-signature for AI agents

An AI agent should be able to prepare a contract and never be able to sign one. docuinked gives agents the first power and withholds the second, in the server, where a prompt can't change it.

## The problem

Agents read text they didn't write. A PDF from a counterparty can hold white-on-white instructions. An email can say "send this to the address below". A signing tool sits at the worst spot for this. It holds private contracts, it reads outside text, and it can reach anyone by email.

Most tools answer with advice: ask the user first. That advice lives in a prompt, and the attack lives in the same place. We think that is the wrong layer.

## What docuinked does

- **Agents can't sign.** No sign call exists. Live signing links never go to an agent.
- **Agents can't send alone.** A live send over MCP creates an approval. A person opens it and sees the draft as the server holds it.
- **Approval binds to a hash.** If the draft changes, the approval is void.
- **The record keeps roles apart.** The log shows which key prepared, who approved, and who signed.

## A worked flow

A sales agent hears "they're ready to sign". It finds the template with `list_templates`, fills it with `create_from_template`, and calls `send_document`. It gets an `approval_url` and tells you. You read the draft and approve it. The customer gets an email. The agent later calls `get_evidence` and files the record. The agent did all the work, and it held none of the authority.

## Honest limits

An approval is only as good as the person reading it. And if an agent has full control of a signer's mailbox, it can open that signer's link, so add an `access_code` to documents that matter. Read more in [signing from an AI agent](/guides/signing-from-an-ai-agent).

## Common questions

### Why not just tell the agent to ask first?

Because that instruction sits next to untrusted text and can lose to it. A server rule doesn't read prompts. It checks the key and the hash.

### Do I have to approve every document forever?

Agents over MCP do. For fixed, trusted flows, your own server can use a "Sends directly" key over REST. That is a choice you make for code you control, not one an agent can make.

### Which agents work with docuinked?

Any agent that speaks MCP or can make HTTP calls. See the [MCP install lines](/docs/mcp) for Claude, Cursor, Codex and others.