The Three Pillars of Agent Authorization

When building systems where AI agents perform actions on behalf of a human, developers must address three core questions to ensure security and accountability:

  1. Human Authorization: Did the user explicitly consent to this action?
  2. Scope Enforcement: Is this specific action allowed right now, given the current constraints (time, amount, merchant)?
  3. Non-Repudiation: Can we prove the authorization later if a dispute arises?

The method for answering these questions depends on the "stakes" of the action and the relationship between the parties involved. The authors propose a ladder of authorization models based on these factors.

The Stakes and Evidence Ladder

  • Low Stakes (e.g., Coding Agents): In closed ecosystems where actions are reversible (like a coding agent using GitHub or Jira), authorization is handled via simple tool-level permissions (allow/ask/deny). Evidence is provided by standard system logs, as the cost of failure is low and mistakes can be undone.
  • Medium Stakes (e.g., B2B Payments): When money moves between parties who share a trusted infrastructure (like a shared vault or OAuth scopes), trust is borrowed from the platform. Authorization is managed through mandates and scopes, and disputes are settled via existing transaction logs. The parties are known to each other, so cryptographic proof is often unnecessary.
  • High Stakes (e.g., Autonomous Consumer Payments): When an agent transacts with an unknown counterparty, the system requires verifiable proof. The authors propose using layered selective disclosure JWTs (JSON Web Tokens). This allows a merchant to verify the checkout and a processor to verify the payment mandate without either party needing to know the other, providing a cryptographic guarantee of the human's intent.

Inverting the Payment Flow

PayPal is implementing an "approval token" that inverts the traditional synchronous payment flow. Instead of a user finding an item and then approving a payment, the user approves an agent's instructions first. PayPal returns a JSON payload (the approval token) containing the amount, expiry, and permitted merchant. This allows the agent to operate autonomously within a pre-authorized boundary. This model is intended to scale beyond payments to any high-stakes, hard-to-reverse action, such as medical orders, e-signatures, or securities trading.