# Your Agent Just Authorized What?! — Jay Mok & Ben Coumes, Paypal

## Executive summary

The talk outlines a framework for agent authorization in payments, arguing that security requirements depend entirely on the context: specifically, the stakes and whether the transacting parties are known to each other. The discussion moves from low-stakes scenarios (e.g., coding agents using tool permissions) to high-stakes autonomous transactions with unknown counterparties. Solutions include leveraging OAuth scopes for controlled authority in medium-stakes environments, or implementing advanced primitives like layered selective disclosure JWTs and the PayPal approval token to verify mandates autonomously.

## Key takeaways

- The Three Authorization Questions: Any agent authorization system must answer: 1) Did the human authorize this? (e.g., passkey); 2) Is it allowed right now in this scope? (e.g., time-bound token, amount, merchant); and 3) Can we prove it later? (Dispute resolution proof).
- Stakes vs. Counterparties Matrix: The required security model changes based on context: Low stakes (coding agents) rely on system logs and reversibility; Medium stakes (shared vaults/OAuth scopes) use controlled mandates; High stakes (never-met counterparties) require verifiable proof.
- High Stakes Solution: For autonomous payments between unknown parties, the industry should converge on a multi-layered selective disclosure JWT. This allows merchants and processors to verify their specific mandate without knowing each other's relationship.

## Technical details

- Low Stakes (Coding Agents): Authorization is granted per tool using connectors (e.g., GitHub, Jira). Since the ecosystem is closed and actions are reversible, system logs are sufficient proof of authorization.
- Medium Stakes (Shared Vaults): Payments involving known parties utilize a shared vault and OAuth scopes to enforce controlled authority. The mandate includes specific amounts and scopes, relying on existing transaction logs for dispute handling.
- PayPal Approval Token: This new primitive inverts the order flow: users approve instructions via PayPal *before* an agent finds an item or merchant. PayPal returns a JSON payload containing the amount, expiry, and permitted merchant for the agent to transact with.

## Practical implications

- The model for agent authorization can be applied to any high-stakes action that is hard to reverse (e.g., medical orders, e-signatures, securities trading), not just payments.
- By inverting the order flow using mechanisms like the PayPal approval token, users can pre-authorize transactions before an autonomous agent has fully scoped the transaction details.

## Topics

Agent Authorization, Payments Architecture, Distributed Systems Security, OAuth 2.0, JWT (JSON Web Tokens), PayPal, OAuth scopes, Layered selective disclosure JWT

Source: https://www.youtube.com/watch?v=vGn6N4-bxBY