# An AI Agent Got Its User Banned From Resy — Keycard, JPMorgan Chase & AAuth

## Executive summary

The panel discusses the critical need for advanced authorization models to manage autonomous AI agents. Current systems, including OAuth, are insufficient because they are too coarse-grained for agents that operate dynamically. The proposed solution is 'intent-based authorization,' which moves beyond simple scope checks to validate an agent's actions based on the user's overarching 'mission' or 'intent.' Key architectural shifts include separating the agent's 'brain' (LLM) from its 'hands' (tools/credentials) using sandboxes and egress proxies, implementing resource budgets instead of just rate limits, and establishing immutable audit logs for accountability.

## Key takeaways

- Intent-Based Authorization is Necessary for Autonomy: Traditional authorization (like OAuth scopes) is too coarse-grained for agents. Intent-based authorization provides the necessary context (the 'why') to make runtime decisions, ensuring that an agent's actions align with the user's defined mission, rather than just its technical permissions.
- Architectural Separation is Key to Safety: To mitigate risk, the agent's 'brain' (the LLM/model) must be separated from its 'hands' (the tools and credentials). Implementing sandboxes and egress proxies allows for granular, deterministic policy enforcement outside the agent's control.
- Moving Beyond Rate Limits with Budgets: Instead of relying solely on traditional rate limiting, which simply cuts off access, implementing resource 'budgets' provides continuous feedback to the agent about resource consumption, allowing for more controlled and predictable operation.
- Accountability Requires Immutable Logging: For liability and forensics, the audit log must be kept outside the agent's control. This ensures a tamper-proof record of who initiated the action, for what purpose, and what decisions were made, which is crucial for regulatory compliance.

## Technical details

- Intent-Based Authorization: This model provides extra context to authorization decisions at runtime, allowing systems to validate not just *what* an agent can do, but *why* it is doing it. The 'mission' identifier tracks the overall purpose, linking all subsequent decisions and actions.
- OAuth Limitations: OAuth was designed for human-to-website interactions and is ill-suited for autonomous agents because it lacks the necessary context and granularity for dynamic, goal-seeking behavior.
- Agent Architecture (Brain vs. Hands): The recommended architecture separates the decision-making model (the 'brain') from the execution capabilities (the 'hands'). This separation is enforced by sandboxes and egress proxies, which act as external, deterministic policy layers.
- Secure Software Factories: The next generation of software factories must integrate runtime authorization as a core component, moving beyond simple secret management to govern when, how, and by which agent access is granted to production systems.

## Practical implications

- Security teams must shift their focus from traditional authentication (who are you?) to dynamic, context-aware authorization (why are you doing this, and is it safe?).
- Architects should design agent systems with explicit separation layers (sandboxes, egress proxies) to prevent broad standing access.
- Implementing resource budgets and mission tracking provides a measurable way to constrain autonomous agents, improving reliability and reducing operational risk.
- The concept of 'federated protocols' is emphasized as necessary for interoperability across different cloud environments and legacy systems.

## Topics

AI Agents, Authorization, Security Architecture, Fintech, LLMs, Build Engineering, OAuth, AAuth, Resy.com, Keycard

Source: https://www.youtube.com/watch?v=IavxrdVnwXM