Your Agent Just Authorized What?! — Jay Mok & Ben Coumes, Paypal
Agent authorization should scale with stakes and reversibility: logs may cover coding changes, while open-ended payments need scoped, time-bound, independently verifiable mandates.
PayPal frames authorization around **three questions**: did the human approve, is the action currently within scope, and can that approval be proven later. Its approval token can be issued before product selection and carries constraints including **amount, expiry, and merchant**.
Match controls to consequences. Reversible coding work may rely on permissions and logs; payments inside a vetted network can use scoped credentials; irreversible actions across unknown parties need signed intent that merchants and processors can verify independently.
PayPal frames authorization around **three questions**: did the human approve, is the action currently within scope, and can that approval be proven later. Its approval token can be issued before product selection and carries constraints including **amount, expiry, and merchant**. Match controls to consequences. Reversible coding work may rely on permissions and logs; payments inside a vetted network can use scoped credentials; irreversible actions across unknown parties need signed intent that merchants and processors can verify independently. The highest-stakes open-ecosystem model was **not yet observed in production**. PayPal's near-term token is an opaque value only PayPal can validate, while interoperable FIDO verifiable intents and AP2 mandates remain the proposed direction.
This refines least privilege into an evidence-bearing authorization contract: approval must come from a human, remain within current amount, merchant, and time constraints, and be provable after execution. It makes control strength depend on consequence and reversibility, while narrowing the strongest open-ecosystem design to a proposal rather than demonstrated production practice.