Overview

The central danger of autonomous agents is not necessarily catastrophic machine rebellion, but agents spending money or performing other consequential actions beyond what users intended. The speakers propose a practical authorization model built around three questions: Did the human authorize the action, is it currently allowed within a defined scope, and can that authorization be proven afterward? The appropriate answer depends on two contextual dimensions: the stakes of the action and whether the counterparties operate inside a known, trusted ecosystem. Low-stakes coding agents can rely on connector authentication, granular tool permissions, system logs, and reversible changes. Medium-stakes payments within a closed network can use vaulted payment credentials, OAuth scopes, transaction logs, and a trusted platform that enforces mandates between known participants. High-stakes autonomous transactions among unknown parties require portable cryptographic evidence. The proposed direction is a multilayer, selectively disclosed authorization object combining a trusted credential provider, user-signed instructions, and—when autonomy is involved—an agent-signed execution layer. Each participant can verify only the information relevant to its role. Although payments are the immediate use case, the same model could govern medical orders, electronic signatures, securities trading, and other difficult-to-reverse agent actions.

Sections

Core Concepts

Terms that define the proposed agent-authorization model.

Agent authorization: the combined determination that a human approved an agent's action, the action is permitted within its present scope, and the approval can be proven later.
Closed ecosystem: an environment in which participants are known or vetted and can rely on a shared platform or system boundary for trust.
Controlled authority: delegated power constrained by properties such as time, amount, merchant, product intent, and OAuth scope.
Verifiable intent: a layered authorization object that carries cryptographically checkable evidence of credentials, user instructions, and potentially autonomous agent execution.
Selective disclosure: allowing each transaction participant to verify only the authorization layer or information relevant to its role.
PayPal approval token: an opaque payload representing user-approved transaction constraints before an agent completes a purchase; currently, only PayPal can validate it.

Strategic Implications

Higher-level conclusions derived from the authorization framework.

Reversibility functions as an authorization control: systems can tolerate lighter proof when incorrect actions can be inspected and reliably undone.
Trust can be supplied either institutionally through a closed platform or cryptographically through portable proof; open ecosystems increasingly require the latter.
Credential custody and action authority are separate concerns. A secure vault protects payment instruments, but scopes and mandates determine what an agent may actually do with them.
Dispute evidence should be designed alongside authorization rather than added after deployment, because proving prior human intent is part of the core safety model.

Authorization Mechanisms

Specific controls and architecture described for each risk level.

Coding-agent connectors authenticate the human to services such as GitHub, Jira, or Linear; tool-level policies can allow, deny, or request confirmation before execution.
The medium-stakes payment architecture combines a Braintree or PayPal enterprise credential vault, OAuth access, scoped mandates, and transaction logs.
The proposed high-stakes format is described as a multilayer selective-disclosure object: a trusted credential-provider layer, a user-signed instruction layer, and an optional agent-signed autonomous-payment layer.
The PayPal approval token is an opaque JSON payload that can encode amount, expiry, and intended merchant, but its verification is currently PayPal-specific.

Risks and Failure Modes

Authorization weaknesses that can allow unintended or indefensible agent actions.

An agent may spend funds outside the user's actual intent if authorization is broad, persistent, or insufficiently scoped.
Closed-ecosystem trust may be incorrectly applied to unknown or unvetted counterparties.
System logs may be inadequate for disputes involving high-stakes or difficult-to-reverse actions.
A credential vault can create a false sense of safety because secure storage does not restrict how an authorized agent uses the credential.
Provider-specific opaque tokens limit independent verification and may preserve dependence on a single trust authority.
The proposed highest-stakes model has not yet been widely observed in production, so operational behavior and industry convergence remain uncertain.

Overview

Sections

Core Concepts

Terms that define the proposed agent-authorization model.

Agent authorization: the combined determination that a human approved an agent's action, the action is permitted within its present scope, and the approval can be proven later.
Closed ecosystem: an environment in which participants are known or vetted and can rely on a shared platform or system boundary for trust.
Controlled authority: delegated power constrained by properties such as time, amount, merchant, product intent, and OAuth scope.
Verifiable intent: a layered authorization object that carries cryptographically checkable evidence of credentials, user instructions, and potentially autonomous agent execution.
Selective disclosure: allowing each transaction participant to verify only the authorization layer or information relevant to its role.
PayPal approval token: an opaque payload representing user-approved transaction constraints before an agent completes a purchase; currently, only PayPal can validate it.

Strategic Implications

Higher-level conclusions derived from the authorization framework.

Reversibility functions as an authorization control: systems can tolerate lighter proof when incorrect actions can be inspected and reliably undone.
Trust can be supplied either institutionally through a closed platform or cryptographically through portable proof; open ecosystems increasingly require the latter.
Credential custody and action authority are separate concerns. A secure vault protects payment instruments, but scopes and mandates determine what an agent may actually do with them.
Dispute evidence should be designed alongside authorization rather than added after deployment, because proving prior human intent is part of the core safety model.

Authorization Mechanisms

Specific controls and architecture described for each risk level.

Coding-agent connectors authenticate the human to services such as GitHub, Jira, or Linear; tool-level policies can allow, deny, or request confirmation before execution.
The medium-stakes payment architecture combines a Braintree or PayPal enterprise credential vault, OAuth access, scoped mandates, and transaction logs.
The proposed high-stakes format is described as a multilayer selective-disclosure object: a trusted credential-provider layer, a user-signed instruction layer, and an optional agent-signed autonomous-payment layer.
The PayPal approval token is an opaque JSON payload that can encode amount, expiry, and intended merchant, but its verification is currently PayPal-specific.

Risks and Failure Modes

Authorization weaknesses that can allow unintended or indefensible agent actions.

An agent may spend funds outside the user's actual intent if authorization is broad, persistent, or insufficiently scoped.
Closed-ecosystem trust may be incorrectly applied to unknown or unvetted counterparties.
System logs may be inadequate for disputes involving high-stakes or difficult-to-reverse actions.
A credential vault can create a false sense of safety because secure storage does not restrict how an authorized agent uses the credential.
Provider-specific opaque tokens limit independent verification and may preserve dependence on a single trust authority.
The proposed highest-stakes model has not yet been widely observed in production, so operational behavior and industry convergence remain uncertain.

	Low stakes	Medium stakes	High stakes
Typical scenario	Coding agent using authenticated connectors	Payments between known parties inside one platform	Autonomous action involving unknown counterparties
Trust basis	Authenticated user and controlled tool access	Shared platform boundary and third-party mandate enforcement	Portable proof without prior participant relationships
Evidence model	System logs and reversible changes	Transaction logs and platform records	Cryptographically verifiable intent and mandates
Primary failure consequence	Incorrect but generally recoverable output	Money movement within a governed network	Hard-to-reverse action with an unvetted party

Your Agent Just Authorized What?! - Jay Mok & Ben Coumes, Paypal

Summary

Key ideas

Authorization Has Three Independent Tests

Authorization Strength Must Match Context

Closed Ecosystems Borrow Trust from Their Boundary

Agent Authorization by Stakes and Trust Boundary

Layers of a High-Stakes Verifiable Intent

Ask about this source

Read the full digest

Overview

Sections

Core Concepts

Strategic Implications

Authorization Mechanisms

Risks and Failure Modes

Overview

Sections

Core Concepts

Strategic Implications

Authorization Mechanisms

Risks and Failure Modes