Sponsor trackHuman Seal

How Zoro uses World ID

Before something risky happens, a real person proves “it’s me, and I approve this exact action”, without revealing who they are. A bot can’t fake it and the proof can’t be reused.

Technically: For actions that can’t be undone or that weaken protection, Zoro asks for a Human Seal: a fresh World ID proof that a unique real person approved that exact action, usable once.

Live status is shown in the Console

Explain it like I’m new

Think of it as a bank’s “are you really you?” check, without showing your ID

For a big transfer, your bank asks you to confirm in person. World ID does that for your AI: a real human confirms, and the confirmation only works for that one action.

Without World ID

A “Confirm” button. The AI, a script or malware can click it just as easily as you.

With World ID

Only a unique real person can approve, only this action, only once, and nobody learns who you are.

Words you’ll see, hover for meaning:

From first principles

Why Zoro needs World ID at all.

Five short steps, from the problem to the answer. Each card has a plain version; open “technical version” for the details.

The problem

Some actions can’t be undone, and the one asking for permission is the AI, which is exactly what attackers try to trick.

Show the technical version

Some actions are irreversible or lower your guard: forwarding a private file, paying an unknown recipient, switching a server to observe mode, overriding a block. The thing asking for approval is an AI agent, and the agent is exactly what an attacker is trying to trick.

Why the obvious fix fails

Buttons can be clicked by bots, and passwords or codes can be stolen and reused for something else.

Show the technical version

A “Confirm” button only proves that something clicked: the agent, a script or malware with access to the session can click it too. A password or one-time code can be captured and replayed, and an approval token for one action can be reused for another.

What is actually needed

Proof that a real person approved this one action, which can’t be copied to another action and doesn’t reveal who they are.

Show the technical version

Proof that a real, unique human approved this specific action, which cannot be replayed for a different action or used twice, and which does not reveal who that person is.

Why World ID provides exactly that

World ID proves “a unique human did this” for one named action, and spots any second use, while keeping the person anonymous.

Show the technical version

A World ID proof is a zero-knowledge proof of personhood. It is bound to an action string and a signal, and yields a nullifier that is the same every time the same person proves for the same action, so reuse is detectable, while the person’s identity stays hidden.

So Zoro uses World ID as

The Human Seal: a one-time human signature for one exact risky action, using World ID Proof of Human.

Show the technical version

The Human Seal. Zoro asks for World ID Proof of Human through IDKit: it needs to know that a real person approved and which distinct person (two approvers must be two people), and nothing about who they are. Each approval gets its own World ID action and the action’s digest is the signal, so the proof can only approve that one action, once.

Inside Zoro

What happens, step by step.

Step 1 of 401

Digest the exact action

Zoro writes down exactly what is about to happen and turns it into a short fingerprint.

How exactly?

Zoro builds a digest from the action itself (kind, request id, server and details). Changing any detail changes the digest.

Step 2 of 402

Bind the proof to it

The human’s proof is tied to this one approval and its fingerprint, so it can only ever approve this one thing.

How exactly?

The World ID action becomes zoro-human-seal:<approval id> and the signal zoro-action:<digest>. One action per approval means the same person can approve the same command again next week. Zoro signs the request with its relying-party key, with a time limit no longer than the approval window.

Step 3 of 403

Verify, then check the binding

World checks the person is real; Zoro double-checks the proof is for the right action.

How exactly?

The proof is sent to World’s verify API (/api/v4/verify). Zoro then checks that the action, the signal hash and the environment match what it asked for, and that the credential is Proof of Human. A mismatch or a weaker credential is rejected even if World accepted the proof, because the browser, not World’s signature, chose the credential.

Step 4 of 404

Record the nullifier once

Zoro remembers the proof was used, so trying it again is refused. If World ID is down, nothing risky happens.

How exactly?

The nullifier is stored against that approval. A second proof from the same person on the same approval is a replay and is refused. If World ID is not configured or not reachable, the action does not proceed: Zoro fails closed.

For developers

What a Human Seal request carries

You don’t need this to use Zoro. It is the exact data Zoro writes, so anyone can check it independently.

Field	Value
action	zoro-human-seal:<approval id> (organization joins: one per organization)
signal	zoro-action:<action digest> (hashed with World’s own hash_to_field)
ttl	Up to the approval window; at least 30 seconds
credential	World ID Proof of Human (IDKit proofOfHuman, World ID 4.0; the 3.0 Orb proof is accepted as fallback)
environment	production (World App), sandbox (World ID Sandbox app) or staging (World ID Simulator); test identities are labelled in the UI
nullifier	Stored once per approval, locally; never published
status	awaiting_verification → verified, or cancelled / credential_unavailable / insufficient_credential / mismatched / invalid / expired / replay / service_unavailable

Where you see it in Zoro

Overriding a block on an unsealed tool version
Risky data flows, such as forwarding a private file to an outside address (the Lab’s exfiltration scenario)
Loosening policy on the Strict profile, switching a server to observe mode, and danger-zone actions

What it does not do

It proves a unique human approved the action, not that the human made a good decision.
Staging uses World’s test identities; the Console labels this clearly.
Zoro stores no identity: only the nullifier for that one approval, on your machine.

Read the code

Try it

See World ID doing its job inside Zoro.

Try it in the Attack Lab Approvals in the Console World ID docs

The other tracks

Public registry

How Zoro uses ENS

Read the ENS track

Verdict ledger

How Zoro uses Hedera

Read the Hedera track