Your Agent Just Authorized What?! — Jay Mok & Ben Coumes, Paypal

Hello everybody, how are you doing? Um, does anybody remember the movie Terminator? Anyway, it's one of my favorite movies when I was growing up as a kid, and it imagines a world where the machines have taken over,right? And the nightmare scenario here, though, in 2026, is not that the machines or the agents are launching nukes, but rather they've taken your wallet and they've gone on a shopping spree, and they buy, like, a bunch of crypto and new bunch of, bunch of spanks for you.

But basically, today we're talking about how we safeguard against that, and hopefully we can kind of share a mental model that you can use when you're thinking about agent authorization. My name is Jay Mok, I'm a product manager over at PayPal in agentic payments, and—

Hi everyone, I'm Ben Coumes. I am a staff software engineer on the payment, PayPal enterprise payments team.

And together we're going to share, kind of like, some knowledge with you, so hopefully you find it helpful. Okay, so the key questions that we kind of like start off with is, in terms of like agent authorization, is did the human authorize this?

Is this allowedright now in this scope, and can we prove it later? Right? And we kind of like try to make it general, but in our world of payments, did the human authorize this? That could be like a passkey or of that nature.

Is this allowedright now in this scope? It's generally going to be a time-bound, you know, token and an amount, and possibly could be identifying like a merchant or the

actual product intent. Then lastly, can we prove it later? This is like if something goes wrong,right? And in our world of payments, this generally has to do with like the disputes and, in that case, and how you can you prove that, you know, the human generally authorized that transaction,right?

But we think the way that you actually answer these three questions is really dependent on the context. You know, I know context is an overused term, but in this case, what we mean is, you know, is it a low stakes or high stakes kind of scenario?

And is this a kind of like open ecosystem or closed ecosystem? Do the parties like know each other? You know, people use the term KYA a lot, know your agent, but you know, what we think about in this scenario is really about, is it like an open or closed ecosystem,right?

And in a payments context, it could be like, hey, you know, ChatGPT or Gemini,right? That's like kind of like a more of like a closed ecosystem because, you know, those agents know the merchant generally. I like to use an analogy.

I like analogies. And the analogy I like to use is kind of like the, you know, badging into work. You badge into work in the front desk, you basically are then led into the building or, you know, let's say it's a set of buildings.

You don't need to like badge in every single time, to every other or for every single room, because you're already within that trusted boundary,right? So then when you meet someone within that, within your office building, you kind of have some element of trust, or hopefully you have some element of trust, because you're both employees of the same company that badged in,right?

So that's kind of like the analogy I may use later in the presentation. Okay, so based on those key questions, we kind of think about like, hey, what's the mental model that we can build off of this,right? And we have this like stakes and evidence matrix, and we're going to talk about these three different scenarios.

And so we're going to first, and you'll see at the top, it's kind of like the stakes and counterparty part that I was just talking about, the context,right? Counterparty is like the open or closed ecosystem. And then authority and like evidence is really about how you answer those three questions I had shared in the prior slide,right?

So we'll talk a little bit first about like Claude Code since that's what most people are very familiar with. And basically, you know, when you as a human, you're using your Claude Code, you know, you might be then setting up your connectors with your GitHub or, you know, Jira or whatever, Linear or whatever tool you're using.

And, you know, as part of that process, you're kind of like authenticating, so that's how you kind of like get that human authorization and consent with those applications and for Claude to interact with them. In terms of the actual like scopes,right, the example here would be then about, you know, Claude's like tool permissions.

Like people are very familiar probably with the fact that you can allow Claude to use certain tools, deny or ask Claude to ask you before doing something,right? And then in terms of the action of like a code, we generally think, because it's a kind of closed ecosystem and it's like your coding, the stakes are relatively low here.

And so in terms of evidence or proof, you don't really need to have like that cryptographic proof at that point in time. You can kind of just look at like system logs in order to, or you have the ability to just revert your changes,right?

So that's kind of like an example of applying like this mental model using Claude Code in terms of that scenario. Okay, so the next example we're going to talk about is a more medium stakes scenario and why we're calling this medium stakes, even though it's within a known or kind of closed ecosystem, is because it has to do with money and payments.

And so that's like the shared vault and OAuth scope example.

So in this example, where the use case is like, hey, you're like a, let's say a merchant or a trip advisor,right? And you have a travel company, and you have a lot of great content that you want to monetize.

It could be occupancy data, it could be like reviews, what have you. And you have a new customer now. You have like a travel agent or like, you know, agents that are buyer agents that are coming to you, and you want to be able to monetize your data,right, through machine payments.

So we work with a partner in Evermind to be able to enable that use case and leveraging our, they're leveraging our infrastructure,right? So there's two pieces of infrastructure that I like to kind of call out or privilege that they use as part of the brain tree or PayPal enterprise infrastructure.

One is like the vault,right? And the vault by itself, which is storing all these like payment credentials on behalf of the, on behalf of the buyer agents, on itself doesn't really do much. But in order to create, what Nevermind creates is a more

closed ecosystem. They then, you're able to offer access to those payment credentials through OAuth,right, to all those merchants. So in our example before, we talked about that

travel company,right? So by doing so, they're able to then create like an ecosystem of buyer agents and seller agents and have a more trusted environment,right? So

in the, just kind of talking more about the use case, like the human then is then going to be authorizing their payment. Usually this is a commercial use case. So you're using like a commercial card, they share it with the buyer agent, travel agent.

Then that, it also has scopes associated with that mandate. So that's how you're able to do controlled authority. But in terms of like the actual like dispute handling, we really don't have like a, we're not using like cryptographic proof that's being sent as part of that request,right?

At the end of the day, they can, since it's more of a closed ecosystem, they're able to leverage like just the existing transaction logs,right? So that's kind of an example of like a medium stakes use case or scenario.

And we believe it's medium stakes because of the fact that it is a more closed ecosystem and doesn't require all like the, you know, evidence in terms of, or proof,right? So that's kind of like my part. I'm going to turn it over now to Ben and take it from here.

Thanks, Jay.

Yeah, so the last slide that Jay talked about, you know, we're kind of going over the medium stakes example. In that scenario, you know, both parties know each other. They're acting within, you know, the same system. They, you know, they're borrowing trust from, you know, Nevermind to make sure that, you know, the buying agent is following within, you know, the instructions that a human has given it.

And then the selling agent that's also on Nevermind can feel comfortable taking a payment from another user of Nevermind. And so what we want to talk about next is what happens when the parties are not known to each other and they're not vetted.

And so like we think, you know, we believe that the best option for that, you know, is to actually do these autonomous payments

where, you know, not everyone's known and, you know, the stakes are high. You know, we think that the industry should converge on the FIDO verifiable intents and AP2 mandate. You know, the TL;DR of that is, you know, it's a multi-layered selective disclosure job.

The first layer is, you know, created by a trustworthy credential provider. You know, in this case, hopefully it would be PayPal. The second layer, you know, encapsulates the user's instructions to the agent. The user signs that with their private key.

And then the third layer, if there's going to be a third layer, is when we're doing autonomous payments. So that case, the agent would, you know, sign that third layer. And so where that's powerful is that, you know, each party involved in a transaction can verify the part that's, you know, important to them.

So merchants can verify that the checkout is correct. Payment processors can verify that the payment mandate's correct. And no one has to have any relationship to each other. And so I think, you know, if there's going to be autonomous payments, you know, at scale, we think that that's going to be the best way to accomplish it.

The pictures on the screen are depicting our PayPal approval token. This is a new primitive that allows users of PayPal to basically start the order process with an agent before that agent's actually found an item and a merchant to transact with.

Historically, PayPal orders have been synchronous. You know, users on checkout, they find their item, they go to their PayPal app, they approve it, and it's done. Here, it's a little bit different. You know, users on their agent, they get redirected to PayPal to confirm the instructions that are given to the agent, and then PayPal hands back this JSON payload.

You know, similar to the verifiable intent, it includes the amount, the expiry, the merchant that it's supposed to be transacted with. Similar concept, but not quite the same. It's an opaque string that only PayPal can approveright now. But we're about to ship this in production, and users of Gemini that pick PayPal as their payment method will use this.

So going to our last slide, you know, we showed this slide earlier. We didn't have the two columns filled out on theright-hand side. You know, we want to reinforce this mental model where, you know, starting at the top, we have, you know, the low stakes scenario.

You know, you're using Claude, you've given it access to connectors, you know, granular permissions to do things on your behalf. You feel comfortable doing that because the stakes are low. You know, you can reverse those actions or redo them.

It's not a big deal if Claude produces, you know, the wrong output. Going down a level, we have the medium stakes scenario. You have two parties that know each other that are acting within the same system's boundary. You know, the actions are a little bit higher stakes.

You know, there is money movement here, but both parties can feel comfortable, you know, transacting with each other because they're relying on this third party to enforce the payment mandate. And then the third level, you know, the high stakes one that we haven't actually seen in production yet is, you know, the user's given an agent some instructions to do something on their behalf autonomously, and you don't know who they're going to interact with, who they're going to transact with.

And those parties need some verifiable proof that the agent has permission to do the transaction. And so we believe that that will be

FIDO verifiable intents and AP2 mandates. I think the interesting thing is like, it's also our belief that, you know, this is a model that won't just be used for payments, but we think it could be for any sort of high stakes action that's hard to reverse.

So medical orders, e-signatures, securities trading, you know, basically any hard-to-reverse agent action. That's all I have.

Yeah, I mean, I think if we could just go back to analogies, you know, like in the low stakes is kind of like, hey, you're within the building, you've put badge in, you're within the building. Whereas in the high stakes is kind of like you are on the street and you meet somebody and, you know, you need a way to be able to get comfort that that's someone you can trust,right?

Is a badge, is them showing you their badge good enough? Probably not. You need to have something that's a little bit more, you know, verifiable,right? I guess at a verifiable standard. So, you know, just kind of like using that analogy and like how to think about like the, you know, what you need to do in order to

prove that the human authorized the agent. Hopefully that helps. And now you have kind of like a tool set to use so you can kind of prevent Skynet from taking over your wallet. So thank you very much for your, for listening.

I hope that helps.