Your Agent Just Authorized What?! — Jay Mok & Ben Coumes, Paypal

Terminator, and the agent that empties your wallet

00:12Hello everybody. How you doing? Um, does anybody remember the movie Terminator? Uh, anyway, it's one of my favorite uh movies when I was growing up as a kid and imagines a world where the machines have taken over, right? And uh uh the nightmare scenario here though in in 2026 is not that the machines are or the agents are launching nukes, but rather uh they've taken your wallet and they've gone on a shopping spree and they buy like a bunch of crypto and new bunch of bunch of Spanx for you.

00:47Um but uh basically today we're talking about how we safeguard against that and uh and a hopefully we can kind of share a a mental model that you can use when you're thinking about agent authorization. Uh my name is uh Jay Mach. I'm a product manager over at PayPal in Agentic Payments.

01:04And everyone, I'm Ben Kums. I am a staff software engineer on the payment PayPal enterprise payments team. and together we're going to share kind of like some knowledge with you. Um so hopefully uh you find it helpful. Okay.

Three questions any agent authorization has to answer

01:26So uh the the key questions that we kind of like uh start off with is uh in terms of like agent authorization is uh did the human authorize this? Um is this allowed right now in this scope and can we prove it later? Right? And we we kind of like try to make it general, but in our world of payments, you know, did the human authorize this?

01:43Uh that could be like a Pasi or of of that nature. Uh is this allowed? Right now in the scope, it's generally going to be a timebound um you know, you know, token. Um and an amount and possibly could be identifying like a a merchant or a um um the actual product intent.

02:07Then lastly, can we prove it later? This is like if something goes wrong, right? And in our world of payments, this generally has to do with like the disputes and in that case and how you can you prove that um you know the uh the human generally authorized that transaction, right?

02:23Um but we think the way that you actually answer these three questions is really dependent on the context. You I know context is a overused term but uh in this case what we what we mean is um you know is it a low stakes or high stakes kind of uh uh scenario?

02:42Um and uh is

Stakes, counterparties, and the badge analogy

02:49this a uh kind of like open ecosystem or closed ecosystem? Do the parties like know each other? You know, people use the term KYA a lot, know your agent, but you know, what we think about in this scenario is is is really about is it like an open or closed ecosystem, right?

03:06And uh in a payments context, it could be like, hey, you know, Chad GBD or Gemini, right? That's like kind of like a more of like a closed ecosystem because, you know, th those agents know the merchant. Uh generally, um I like to use a uh an analogy.

03:20Uh I I I like analogies and the analogy I I like to use is kind of like the uh you know badging into work. You badge into work in the front desk. You uh basically are are then uh led into the building or you know let's say it's a set of buildings.

03:37You don't need to like badge in every single time to every other or for every single room because you're already within that trusted boundary, right? So then when you meet someone in within that within your your office building uh you kind of have some element of trust or hopefully have some element of trust uh because you're both uh employees at the same company that badged in.

03:52Right? So um that's kind of like the analogy I may I may use later in the presentation. Okay. So based on those key questions we kind of think about like hey what's the mental model that we can build off of this right? And we have this like stakes and evidence matrix.

04:05And we're going to

Low stakes: a coding agent with allow, ask and deny

04:14talk about uh these three different scenarios. Um and so uh we're gonna first uh and you'll see at the top it's got like the stakes and counterparty part that I was just talking about the context, right? Counterparty is like the open or closed ecosystem.

04:21And then authority and like evidence is really about how do you answer those those those three questions I shared in in the prior slide, right? Um so we'll talk a little bit first about like cloud code since that's what most people are very familiar with and uh basically you know when you as a human you're you know using your cloud code uh you know you might be uh then setting up uh your your connectors with your GitHub or or um you know Jira or whatever uh linear or whatever tool you're using and um you know you as part of that process you're kind of like authenticated.

04:52So that's how you kind of like get that that human authorization and consent um with those those applications and to for the a for cloud to interact with them. Um in terms of the uh uh actual like uh scopes right the the example here would be then about you know cloud's like tool permissions like people are very familiar probably with uh the fact that you can allow cloud to to use certain tools um deny or ask cloud to ask you uh before for before for before doing something right and then in terms of uh the action of

05:34like co uh we generally think uh because it's a kind of closed ecosystem I mean it's like you're coding the stakes are relatively low here. And so in terms of evidence or proof, you don't really need to have like that cryptographic proof um at that point in time.

05:41You can kind of just look at like system logs in order to to or you have the ability to just revert revert your changes, right? Um so that's kind of like uh an example of of applying like this mental model um using clog code in terms of that scenario.

06:07Okay. The next uh uh example we're going to talk about is uh um a more medium stakes uh scenario. And why why we're

Medium stakes: a shared vault and OAuth scopes

06:15calling this medium stakes even though it's within a known or kind of closed ecosystem is because it has to do with money and and payments. And uh so that's like the shared vault and oascope example. So in this example where the use case is is like hey you're like a um let's say a merchant or trip adviser right and you have um uh a travel travel company and you have a lot of great content that you want to monetize.

06:44It could be occupancy data, it could be like reviews, what have you. And you have a new customer now. You have like a tra like travel agents or like you know agents that that are buyer agents that are are coming to you and you want to be able to uh monetize uh monetize your data right through machine payments.

06:59Um so we work with a partner never mind to be able to enable that that that use case and leveraging our um they're leveraging our uh infrastructure right so there's two pieces of infrastructure they they um that I like to kind or primitives that they use that u as part of the brainree or PayPal enterprise um uh infrastructure one is like the vault right and the vault by itself which is uh storing all these like uh uh payment credial ials on behalf of the on behalf of the buyer agents um on itself doesn't really uh do much but in order to create uh what never mind creates is a uh a

07:45more um uh eco closed ecosystem they then off you're able to um offer uh or offer access to those payment credentials through uh ooth right to all those merchants. So in our example before we talked about that that travel travel um travel company, right?

08:00So, by doing so, they're able to then create like an ecosystem um of buyer agents and seller agents uh and have a more trusted um environment, right? So, um in in the just kind of talking more about the use case like the human then is then going to be authorizing authorizing their their payment.

08:25Usually, this is a commercial car, a commercial use case. Uh so using like a commercial car they share it with the buyer agent travel agent um then uh that uh it also has uh scopes associated with that mandate. So that's how you're able to do controlled authority.

08:42But in terms of like the actual like dispute handling, we really uh don't have like a uh we're not using like u cryp uh cryptographic proof that's being sent as part of that that request, right? uh at the end of the day they can um since it's more of a a closed ecosystem u they're able to leverage like the just the existing uh um transaction logs right so that's kind of an example of like a medium stakes um use case or scenario and u we we believe it's medium stakes because of the fact that it is a more closed ecosystem and doesn't

09:24require all like the uh um um you you know, evidence in terms of uh um for or proof, right? So, that's kind of like my part. I'm going to turn over now to Ben and uh take it from here. Uh thanks, Jay. Yeah. So, the last slide that Jay talked about um you know, we're kind of going over the BDM stakes example.

09:43Uh in that

High stakes: counterparties who have never met

09:52scenario, um you know, both parties know each other. uh they're acting within you know the same system the you know you know they're borrowing trust from you know nevermind to make sure that you know the buying agent is falling within you know the instructions that a human has given it um and then the selling agent that's also on nevermind can feel comfortable taking a payment um from another user of of never mind and so what we want to talk about next is what happens when the parties are are not known to each other and they're not

10:25vetted Um and so like we think you know we believe that the best option for that you know to actually do these autonomous

A layered selective disclosure JWT

10:33payments um where you know you know not everyone's known like the stakes are high you know we think that the industry should converge on the phto verifiable intents and AP2 mandate um you know the TLDDR of that is you know it's a a multi-layer selective disclosure jot uh the first layer layer is, you know, created by a trustworthy credential provider.

10:51You know, in this case, hopefully it would be PayPal. Um, the second layer, you know, encapsulates the user's instructions to the agent. Um, the user assigns that with their private key. And then the third layer, if there's going to be a third layer, is when um we're doing autonomous payments.

11:07So that case, the agent would, you know, sign that third layer. And so the where that's powerful is that, you know, party involved in a transaction can can verify the part that's you know important to them. So merchants can verify that the checkout is correct.

11:32Um payment processors can verify that the payment mandates correct. Um and no one has to have any relationship to each other. Um and so like I think you know if there's going to be autonomous payments you know at scale we think that that's going to be the best um way to accomplish it.

11:53Uh the pictures on the screen are depicting our PayPal approval token. Um this is a new primitive that allows users of PayPal to basically start the order process with an agent before that agents actually found an item and a merchant to transact with.

12:08Uh historically, PayPal orders have been synchronous. Um you know, users on checkout, they find their item, they go to their PayPal app, they approve it. um it's done. Here it's a little bit different. You know, users on their agent um get redirected to PayPal to confirm the instructions that given to the agent and then uh PayPal hands back

The approval token, and inverting the order flow

12:33this JSON payload. Um you know, similar to verifiable intent includes the amount, the expiry uh the merchant that is supposed to be transacted with. Um similar concept but not quite the same. Um it's an opaque string that only can approve right now.

12:47Um, we're about to ship this in production. Um, and users of Gemini that pick a pal as a payment method will will use this. So, going to our last slide, um, you know, we showed this slide earlier. We didn't have the two columns filled out on the right hand side.

13:08Um, you know, we want to reinforce this mental model where, you know, starting at the top, we have, you know, the low stakes scenario. You know, you're using claude. you've given it access to connectors, you know, granular permissions to do things on your behalf.

13:17Um, you feel comfortable doing that because the stakes are low, you know, you can reverse those actions or redo them. It's not a big deal if cla produces, you know, the wrong output. Uh, going down a level, we have the medium stake scenario.

13:33You have two parties that know each other that are acting within the same systems boundary. Um, you know, the the actions are a little bit higher stakes. you know, there is money movement here, but both parties can can feel comfortable, you know, transacting with each other because they're relying on this this third party to enforce uh the payment mandate.

13:56And then the third level, you know, the highest stakes one um that we haven't actually seen in production yet is, you know, the user's given an agent some instructions to do something on their behalf autonomously, and you don't know who they're going to interact with, who they're going to transact with.

14:05um and those parties need some verifiable proof that the agent has permission to do the transaction and so we believe that that will be um I know verifiable debts and a AP2 mandates um I think the interesting thing is like it's also our belief that you know this is a model that won't just be used for payments but we think it can

Why the ladder applies beyond payments

14:33be for any sort of high stakes action that's hard to reverse so medical orders e signatures securities trading um you know basically any hard to reverse agent action. That's all I have. Yeah. I mean, I think um if we could just go back to analogies, uh you know, like in the low stakes is kind of like, hey, you're within the the building, you've uh put badges in, you're within the building, whereas in the um high stakes, it's kind of like you are on the street and you meet somebody and uh you know, you need a way to be able to uh get comfort that that's someone you can trust, right?

15:08Um, is the badge is them showing you their badge good enough? Uh, probably not. You need to have something that's a little bit more um, you know, verifi verifiable, I guess, at a verifiable standard. So, um, you know, just kind of like using that analogy and like how to think about like the uh, you know, what you need to do in order to uh, um, um, prove the that the human authorized the agent.

15:29Uh hopefully that that helps and uh now you have kind of like a tool set to use um so you can kind of prevent Skynet from uh taking over your wallet. So thank you very much for for listening. Hope that helps.