Your Agent Just Authorized What?! — Jay Mok & Ben Coumes, Paypal
Summary
The talk outlines a framework for agent authorization in payments, arguing that security requirements depend entirely on the context: specifically, the stakes and whether the transacting parties are known to each other. The discussion moves from low-stakes scenarios (e.g., coding agents using tool permissions) to high-stakes autonomous transactions with unknown counterparties. Solutions include leveraging OAuth scopes for controlled authority in medium-stakes environments, or implementing advanced primitives like layered selective disclosure JWTs and the PayPal approval token to verify mandates autonomously.
Key takeaways
-
The Three Authorization Questions
0:01
Any agent authorization system must answer: 1) Did the human authorize this? (e.g., passkey); 2) Is it allowed right now in this scope? (e.g., time-bound token, amount, merchant); and 3) Can we prove it later? (Dispute resolution proof).
-
Stakes vs. Counterparties Matrix
0:02
The required security model changes based on context: Low stakes (coding agents) rely on system logs and reversibility; Medium stakes (shared vaults/OAuth scopes) use controlled mandates; High stakes (never-met counterparties) require verifiable proof.
-
High Stakes Solution
0:10
For autonomous payments between unknown parties, the industry should converge on a multi-layered selective disclosure JWT. This allows merchants and processors to verify their specific mandate without knowing each other's relationship.
Technical details
-
Low Stakes (Coding Agents)
4s
Authorization is granted per tool using connectors (e.g., GitHub, Jira). Since the ecosystem is closed and actions are reversible, system logs are sufficient proof of authorization.
-
Medium Stakes (Shared Vaults)
6s
Payments involving known parties utilize a shared vault and OAuth scopes to enforce controlled authority. The mandate includes specific amounts and scopes, relying on existing transaction logs for dispute handling.
-
PayPal Approval Token
12s
This new primitive inverts the order flow: users approve instructions via PayPal *before* an agent finds an item or merchant. PayPal returns a JSON payload containing the amount, expiry, and permitted merchant for the agent to transact with.
Mentioned resources
- PayPal
- OAuth scopes
- Layered selective disclosure JWT
Channel & topics
Watch on YouTube · Back to latest
This independent, AI-assisted summary is provided for commentary and informational purposes. It may contain errors or omit important context. Please watch the original video for the creator's complete presentation. Video, thumbnail, and related copyrights belong to their respective owners.