How do you expect to prove the identity of the user? If you have a way to assure the identity of the user, you could simply require an actual event (even as little as a checkbox) to cause the binding of the transaction. Of course, you could go as complex as using a PKI and having them digitally sign the transaction with a client certificate. Heck, you can do this with Rights Management Services if you really want to.
However, you are putting the cart before the horse. Before fretting about the technology you want to use, you have to really model out what you want to accomplish, what roles and access is required to do it, and how you will complete the transaction. Do you have a rudamentary data flow diagram, showing where your user data is coming from, how you expect the communications to work, and where your trust boundaries exist?
If we could understand your existing infrastructure, bound with a clear understanding of how the data will flow, we can help a bit more.
And the good thing is, you will need the DFD for the threat modeling anyways :-)
Dana Epp
Microsoft Security MVP
