The Two-Person Rule for AI Agents: Fail-Closed Multi-Party Authorization with Offline-Verifiable Receipts

Autonomous agents increasingly hold credentials sufficient to perform irreversible operations: releasing payments, changing beneficiary records, rotating production credentials, deleting data. Existing controls authenticate and authorize sessions and scopes; they do not answer the question that matters at the moment of execution — should this exact action happen, and which accountable humans said yes? We present EP-QUORUM, a multi-party authorization mechanism that ports the two-person rule — the control that governs nuclear release and large-value treasury movement — to AI-agent actions. EP-QUORUM binds a set of pairwise-distinct, accountable human approvers, each holding their own device-bound signing key, to one exact action, such that the action is authorized only when a fail-closed predicate over all of their signatures holds. The predicate enforces all-signatures-valid, action-binding, separation of duties (distinct humans), role admission, an M-of-N threshold, an optional total order, and a bounded approval window. Each quorum member is an unmodified single-approver authorization receipt over the same action hash, so the construction is additive: a single-approver policy is the degenerate one-member case, and the existing offline receipt verifier is reused per member. We give the predicate, an incremental server-side admission rule that keeps a non-conforming signer out of the trail before it is recorded, and an adversarial conformance suite of nine vectors that three independent implementations (JavaScript, Python, Go) are required to agree on. We are deliberate about limitations: a quorum raises the cost of unilateral action and makes every approval attributable, but it does not defeat collusion among the required number of humans, an enrollment that lets one human hold multiple identities, or simultaneous coercion — and we argue that honesty about these boundaries is a security property, not a caveat.