# Your Agent Just Authorized What?! — Jay Mok & Ben Coumes, Paypal

Source: [AI Engineer](https://www.youtube.com/watch?v=vGn6N4-bxBY)  
Feed7 permalink: https://feed7.dev/p/your-agent-just-authorized-what-jay-mok-ben-coumes-paypal-024znqi  
Published: 2026-09-01T18:30:06.000Z  
Trust: Source Linked (source_linked)

## Why Included

Agent authorization should scale with stakes and reversibility: logs may cover coding changes, while open-ended payments need scoped, time-bound, independently verifiable mandates.

## Source Summary

PayPal frames authorization around **three questions**: did the human approve, is the action currently within scope, and can that approval be proven later. Its approval token can be issued before product selection and carries constraints including **amount, expiry, and merchant**.

## Practical Implication

Match controls to consequences. Reversible coding work may rely on permissions and logs; payments inside a vetted network can use scoped credentials; irreversible actions across unknown parties need signed intent that merchants and processors can verify independently.

## Agent-Ready Context

PayPal frames authorization around **three questions**: did the human approve, is the action currently within scope, and can that approval be proven later. Its approval token can be issued before product selection and carries constraints including **amount, expiry, and merchant**.

Match controls to consequences. Reversible coding work may rely on permissions and logs; payments inside a vetted network can use scoped credentials; irreversible actions across unknown parties need signed intent that merchants and processors can verify independently.

The highest-stakes open-ecosystem model was **not yet observed in production**. PayPal's near-term token is an opaque value only PayPal can validate, while interoperable FIDO verifiable intents and AP2 mandates remain the proposed direction.

## Connected Context

Feed7 judgment across 669 accumulated Signals:

This refines least privilege into an evidence-bearing authorization contract: approval must come from a human, remain within current amount, merchant, and time constraints, and be provable after execution. It makes control strength depend on consequence and reversibility, while narrowing the strongest open-ecosystem design to a proposal rather than demonstrated production practice.

- [Teaching agents to pay — Anna Spysz, Stripe](https://feed7.dev/p/teaching-agents-to-pay-anna-spysz-stripe-04jxy0s) — Stripe’s external limits, cancellation, disclosure, and logs complement PayPal’s approval token by covering execution and recovery around the scoped authorization.
- [AI Agents Are Just Distributed Systems Now — Salman Munaf, TikTok](https://feed7.dev/p/ai-agents-are-just-distributed-systems-now-salman-munaf-tiktok-1v4yc47) — Signed intent answers who authorized what, while idempotency, reconciliation, and compensation address the separate unknown-outcome problem after a payment tool call begins.
- [In Code They Act, In Proof We Trust — Erik Meijer, Leibniz Labs](https://feed7.dev/p/in-code-they-act-in-proof-we-trust-erik-meijer-leibniz-labs-1lyno2y) — The proof-gated harness applies the same pre-side-effect principle more generally, but PayPal grounds it in human attribution and constraints that merchants and processors can verify.
- [Tribal Dungeons of Global Shipping: AI Agents at Global Scale — Dmitry Buykin, Maersk](https://feed7.dev/p/tribal-dungeons-of-global-shipping-ai-agents-at-global-scale-dmitry-buyk-0kcigeh) — Maersk’s bounded tools and replayable traces reinforce that scoped authority and provable history must be maintained as operational infrastructure, not treated as a one-time approval prompt.

## Context Map

- Layer: agent
- Domains: coding, security
- Topics: tool-use, harness-engineering, agent-reliability

## Uncertainty

- The highest-stakes open-ecosystem model was **not yet observed in production**. PayPal's near-term token is an opaque value only PayPal can validate, while interoperable FIDO verifiable intents and AP2 mandates remain the proposed direction.

## Agent Instruction

Use this item as source-backed context. Do not invent claims beyond the linked source. If this item conflicts with another source, call out the conflict.