Your Agent Just Authorized What?! — Jay Mok & Ben Coumes, Paypal
The talk outlines a framework for agent authorization in payments, arguing that security requirements depend entirely on the context: specifically, the stakes and whether the transacting parties are known to each other. The discussion moves from low-stakes scenarios (e.g., coding agents using tool permissions) to high-stakes autonomous transactions with unknown counterparties. Solutions include leveraging OAuth scopes for controlled authority in medium-stakes environments, or implementing advanced primitives like layered selective disclosure JWTs and the PayPal approval token to verify mandates autonomously.
Key takeaways
-
The Three Authorization Questions
0:01
Any agent authorization system must answer: 1) Did the human authorize this? (e.g., passkey); 2) Is it allowed right now in this scope? (e.g., time-bound token, amount, merchant); and 3) Can we prove it later? (Dispute resolution proof).
-
Stakes vs. Counterparties Matrix
0:02
The required security model changes based on context: Low stakes (coding agents) rely on system logs and reversibility; Medium stakes (shared vaults/OAuth scopes) use controlled mandates; High stakes (never-met counterparties) require verifiable proof.
-
High Stakes Solution
0:10
For autonomous payments between unknown parties, the industry should converge on a multi-layered selective disclosure JWT. This allows merchants and processors to verify their specific mandate without knowing each other's relationship.