# Your Agent Just Authorized What?! — Jay Mok & Ben Coumes, Paypal AI Engineer · 2026-09-01 PayPal's Jay Mok and Ben Coumes tie agent authorization to three questions — did the human authorize it, is it allowed in scope, can you prove it later — answered by stakes and familiarity. Low stakes is the coding agent: allow/ask/deny permissions plus system logs, since actions revert. Medium stakes is money in a closed ecosystem — Evermind's shared vault plus OAuth scopes, with the amount-bound mandate and transaction logs settling disputes. High stakes: autonomous payments between strangers need a layered selective disclosure JWT per FIDO/AP2 — merchants verify checkout, processors verify the mandate. The approval token inverts the flow: users approve before an agent finds an item; PayPal returns a payload with amount, expiry and merchant, starting with Gemini. ## Questions this episode answers ### What is PayPal's approval token and how does it invert the normal order flow? Ben Coumes explains the approval token lets users start an order with an agent before the agent has found an item or merchant. Instead of synchronous checkout, users confirm the agent's instructions on PayPal, which returns a JSON payload with the amount, the expiry, and the merchant, as an opaque string only PayPal can approve. It was about to ship for Gemini users picking PayPal. [11:54](https://aiengineer.podhood.com/a5c5f728-e437-4dae-b7d5-0479f16cc636?t=714000) ### How should agent authorization work for high-stakes payments between parties who have never met? Ben Coumes says the industry should converge on FIDO verifiable intents and AP2 mandates, implemented as a multi-layered selective disclosure JWT. A trustworthy credential provider creates the first layer, the user signs the second with their private key, and the agent signs a third for autonomous payments, so merchants verify checkout and processors verify the payment mandate without knowing each other. [10:28](https://aiengineer.podhood.com/a5c5f728-e437-4dae-b7d5-0479f16cc636?t=628000) ### What are the three key questions any agent authorization system has to answer? Jay Mok lays them out as: did the human authorize this, which in payments could be a passkey; is this allowed right now in this scope, generally a time-bound token with an amount and possibly a merchant or product intent; and can we prove it later, which in payments means disputes and showing the human authorized the transaction. [1:19](https://aiengineer.podhood.com/a5c5f728-e437-4dae-b7d5-0479f16cc636?t=79000) ### Why is a coding agent like Claude Code considered low stakes for authorization? Jay Mok explains that when you connect Claude Code to tools like GitHub or Jira, you authenticate once for consent, then set tool permissions as allow, deny, or ask. Because it is a closed ecosystem with low stakes, you don't need cryptographic proof; system logs suffice, and you can simply revert any changes the agent makes. [4:37](https://aiengineer.podhood.com/a5c5f728-e437-4dae-b7d5-0479f16cc636?t=277000) ## Key moments - **[0:00] Intro & Terminator** - [0:13] PayPal's Jay Mok opens with the 2026 nightmare scenario: agents taking your wallet on a shopping spree for crypto and Spanx - [1:19] The three questions any agent authorization system must answer: did the human authorize this, is it allowed in this scope, and can you prove it later? - **[1:26] Three questions** - **[2:49] Stakes & context** - [3:19] Jay Mok's badge analogy: inside a trusted ecosystem you don't re-verify every room, and that's how closed agent ecosystems borrow trust - **[4:12] Low stakes agents** - [4:37] Low-stakes agent authorization: Claude Code uses connector consent, allow/ask/deny tool permissions, and plain system logs because actions are reversible - **[6:15] Shared vault & OAuth** - [7:05] Medium-stakes agent payments: PayPal's shared vault plus OAuth scopes let buyer and seller agents transact inside a closed ecosystem like Nevermind's travel agents - **[9:45] High stakes** - [10:12] Ben Coumes proposes layered selective disclosure JWTs for autonomous payments: merchants verify checkout, processors verify the mandate, no one needs a relationship - **[10:29] Layered JWT** - [11:54] PayPal's approval token inverts the order flow: users approve before the agent finds an item, and PayPal returns a JSON payload with amount, expiry and merchant - **[12:30] Approval token** - **[13:02] The ladder** - **[14:31] Closing analogies** - [14:37] Jay Mok predicts the verifiable-intent model will extend beyond payments to any hard-to-reverse agent action: medical orders, e-signatures, securities trading ## Speakers - **Ben Coumes** (guest) - **Jay Mok** (guest) ## Topics Agent Commerce, Agent Identity & Access Management ## Mentioned Evermind (company), PayPal (company), AP2 (product), Claude Code (product), FIDO (product), Gemini (product), Skynet (product) ## Transcript ### Intro & Terminator **Jay Mok** [0:13] Hello everybody, how are you doing? Um, does anybody remember the movie Terminator? Anyway, it's one of my favorite movies when I was growing up as a kid, and it imagines a world where the machines have taken over,right? And the nightmare scenario here, though, in 2026, is not that the machines or the agents are launching nukes, but rather they've taken your wallet and they've gone on a shopping spree, and they buy, like, a bunch of crypto and new bunch of, bunch of spanks for you. But basically, today we're talking about how we safeguard against that, and hopefully we can kind of share a mental model that you can use when you're thinking about agent authorization. My name is Jay Mok, I'm a product manager over at PayPal in agentic payments, and— **Ben Coumes** [1:12] Hi everyone, I'm Ben Coumes. I am a staff software engineer on the payment, PayPal enterprise payments team. **Jay Mok** [1:19] And together we're going to share, kind of like, some knowledge with you, so hopefully you find it helpful. Okay, so the key questions that we kind of like start off with is, in terms of like agent authorization, is did the human authorize this? ### Three questions **Jay Mok** [1:38] Is this allowedright now in this scope, and can we prove it later? Right? And we kind of like try to make it general, but in our world of payments, did the human authorize this? That could be like a passkey or of that nature. Is this allowedright now in this scope? It's generally going to be a time-bound, you know, token and an amount, and possibly could be identifying like a merchant or the actual product intent. Then lastly, can we prove it later? This is like if something goes wrong,right? And in our world of payments, this generally has to do with like the disputes and, in that case, and how you can you prove that, you know, the human generally authorized that transaction,right? But we think the way that you actually answer these three questions is really dependent on the context. You know, I know context is an overused term, but in this case, what we mean is, you know, is it a low stakes or high stakes kind of scenario? And is this a kind of like open ecosystem or closed ecosystem? Do the parties like know each other? You know, people use the term KYA a lot, know your agent, but you know, what we think about in this scenario is really about, is it like an open or closed ecosystem,right? ### Stakes & context **Jay Mok** [3:07] And in a payments context, it could be like, hey, you know, ChatGPT or Gemini,right? That's like kind of like a more of like a closed ecosystem because, you know, those agents know the merchant generally. I like to use an analogy. I like analogies. And the analogy I like to use is kind of like the, you know, badging into work. You badge into work in the front desk, you basically are then led into the building or, you know, let's say it's a set of buildings. You don't need to like badge in every single time, to every other or for every single room, because you're already within that trusted boundary,right? So then when you meet someone within that, within your office building, you kind of have some element of trust, or hopefully you have some element of trust, because you're both employees of the same company that badged in,right? So that's kind of like the analogy I may use later in the presentation. Okay, so based on those key questions, we kind of think about like, hey, what's the mental model that we can build off of this,right? And we have this like stakes and evidence matrix, and we're going to talk about these three different scenarios. ### Low stakes agents **Jay Mok** [4:18] And so we're going to first, and you'll see at the top, it's kind of like the stakes and counterparty part that I was just talking about, the context,right? Counterparty is like the open or closed ecosystem. And then authority and like evidence is really about how you answer those three questions I had shared in the prior slide,right? So we'll talk a little bit first about like Claude Code since that's what most people are very familiar with. And basically, you know, when you as a human, you're using your Claude Code, you know, you might be then setting up your connectors with your GitHub or, you know, Jira or whatever, Linear or whatever tool you're using. And, you know, as part of that process, you're kind of like authenticating, so that's how you kind of like get that human authorization and consent with those applications and for Claude to interact with them. In terms of the actual like scopes,right, the example here would be then about, you know, Claude's like tool permissions. Like people are very familiar probably with the fact that you can allow Claude to use certain tools, deny or ask Claude to ask you before doing something,right? And then in terms of the action of like a code, we generally think, because it's a kind of closed ecosystem and it's like your coding, the stakes are relatively low here. And so in terms of evidence or proof, you don't really need to have like that cryptographic proof at that point in time. You can kind of just look at like system logs in order to, or you have the ability to just revert your changes,right? So that's kind of like an example of applying like this mental model using Claude Code in terms of that scenario. Okay, so the next example we're going to talk about is a more medium stakes scenario and why we're calling this medium stakes, even though it's within a known or kind of closed ecosystem, is because it has to do with money and payments. ### Shared vault & OAuth **Jay Mok** [6:23] And so that's like the shared vault and OAuth scope example. So in this example, where the use case is like, hey, you're like a, let's say a merchant or a trip advisor,right? And you have a travel company, and you have a lot of great content that you want to monetize. It could be occupancy data, it could be like reviews, what have you. And you have a new customer now. You have like a travel agent or like, you know, agents that are buyer agents that are coming to you, and you want to be able to monetize your data,right, through machine payments. So we work with a partner in Evermind to be able to enable that use case and leveraging our, they're leveraging our infrastructure,right? So there's two pieces of infrastructure that I like to kind of call out or privilege that they use as part of the brain tree or PayPal enterprise infrastructure. One is like the vault,right? And the vault by itself, which is storing all these like payment credentials on behalf of the, on behalf of the buyer agents, on itself doesn't really do much. But in order to create, what Nevermind creates is a more closed ecosystem. They then, you're able to offer access to those payment credentials through OAuth,right, to all those merchants. So in our example before, we talked about that travel company,right? So by doing so, they're able to then create like an ecosystem of buyer agents and seller agents and have a more trusted environment,right? So in the, just kind of talking more about the use case, like the human then is then going to be authorizing their payment. Usually this is a commercial use case. So you're using like a commercial card, they share it with the buyer agent, travel agent. Then that, it also has scopes associated with that mandate. So that's how you're able to do controlled authority. But in terms of like the actual like dispute handling, we really don't have like a, we're not using like cryptographic proof that's being sent as part of that request,right? At the end of the day, they can, since it's more of a closed ecosystem, they're able to leverage like just the existing transaction logs,right? So that's kind of an example of like a medium stakes use case or scenario. And we believe it's medium stakes because of the fact that it is a more closed ecosystem and doesn't require all like the, you know, evidence in terms of, or proof,right? So that's kind of like my part. I'm going to turn it over now to Ben and take it from here. **Ben Coumes** [9:41] Thanks, Jay. Yeah, so the last slide that Jay talked about, you know, we're kind of going over the medium stakes example. In that scenario, you know, both parties know each other. They're acting within, you know, the same system. They, you know, they're borrowing trust from, you know, Nevermind to make sure that, you know, the buying agent is following within, you know, the instructions that a human has given it. ### High stakes **Ben Coumes** [10:12] And then the selling agent that's also on Nevermind can feel comfortable taking a payment from another user of Nevermind. And so what we want to talk about next is what happens when the parties are not known to each other and they're not vetted. And so like we think, you know, we believe that the best option for that, you know, is to actually do these autonomous payments ### Layered JWT **Ben Coumes** [10:37] where, you know, not everyone's known and, you know, the stakes are high. You know, we think that the industry should converge on the FIDO verifiable intents and AP2 mandate. You know, the TL;DR of that is, you know, it's a multi-layered selective disclosure job. The first layer is, you know, created by a trustworthy credential provider. You know, in this case, hopefully it would be PayPal. The second layer, you know, encapsulates the user's instructions to the agent. The user signs that with their private key. And then the third layer, if there's going to be a third layer, is when we're doing autonomous payments. So that case, the agent would, you know, sign that third layer. And so where that's powerful is that, you know, each party involved in a transaction can verify the part that's, you know, important to them. So merchants can verify that the checkout is correct. Payment processors can verify that the payment mandate's correct. And no one has to have any relationship to each other. And so I think, you know, if there's going to be autonomous payments, you know, at scale, we think that that's going to be the best way to accomplish it. The pictures on the screen are depicting our PayPal approval token. This is a new primitive that allows users of PayPal to basically start the order process with an agent before that agent's actually found an item and a merchant to transact with. Historically, PayPal orders have been synchronous. You know, users on checkout, they find their item, they go to their PayPal app, they approve it, and it's done. Here, it's a little bit different. You know, users on their agent, they get redirected to PayPal to confirm the instructions that are given to the agent, and then PayPal hands back this JSON payload. ### Approval token **Ben Coumes** [12:35] You know, similar to the verifiable intent, it includes the amount, the expiry, the merchant that it's supposed to be transacted with. Similar concept, but not quite the same. It's an opaque string that only PayPal can approveright now. But we're about to ship this in production, and users of Gemini that pick PayPal as their payment method will use this. ### The ladder **Ben Coumes** [13:02] So going to our last slide, you know, we showed this slide earlier. We didn't have the two columns filled out on theright-hand side. You know, we want to reinforce this mental model where, you know, starting at the top, we have, you know, the low stakes scenario. You know, you're using Claude, you've given it access to connectors, you know, granular permissions to do things on your behalf. You feel comfortable doing that because the stakes are low. You know, you can reverse those actions or redo them. It's not a big deal if Claude produces, you know, the wrong output. Going down a level, we have the medium stakes scenario. You have two parties that know each other that are acting within the same system's boundary. You know, the actions are a little bit higher stakes. You know, there is money movement here, but both parties can feel comfortable, you know, transacting with each other because they're relying on this third party to enforce the payment mandate. And then the third level, you know, the high stakes one that we haven't actually seen in production yet is, you know, the user's given an agent some instructions to do something on their behalf autonomously, and you don't know who they're going to interact with, who they're going to transact with. And those parties need some verifiable proof that the agent has permission to do the transaction. And so we believe that that will be FIDO verifiable intents and AP2 mandates. I think the interesting thing is like, it's also our belief that, you know, this is a model that won't just be used for payments, but we think it could be for any sort of high stakes action that's hard to reverse. ### Closing analogies **Ben Coumes** [14:37] So medical orders, e-signatures, securities trading, you know, basically any hard-to-reverse agent action. That's all I have. **Jay Mok** [14:46] Yeah, I mean, I think if we could just go back to analogies, you know, like in the low stakes is kind of like, hey, you're within the building, you've put badge in, you're within the building. Whereas in the high stakes is kind of like you are on the street and you meet somebody and, you know, you need a way to be able to get comfort that that's someone you can trust,right? Is a badge, is them showing you their badge good enough? Probably not. You need to have something that's a little bit more, you know, verifiable,right? I guess at a verifiable standard. So, you know, just kind of like using that analogy and like how to think about like the, you know, what you need to do in order to prove that the human authorized the agent. Hopefully that helps. And now you have kind of like a tool set to use so you can kind of prevent Skynet from taking over your wallet. So thank you very much for your, for listening. I hope that helps. --- This library is powered by PodHood (https://podhood.com), the podcast website platform.