{ "video": { "id": "IavxrdVnwXM", "title": "An AI Agent Got Its User Banned From Resy — Keycard, JPMorgan Chase & AAuth", "duration": 2605, "upload_date": null, "channel": "AI Engineer", "source": "AI Engineer", "event_format": "" }, "analysis": { "video_id": "IavxrdVnwXM", "title": "An AI Agent Got Its User Banned From Resy — Keycard, JPMorgan Chase & AAuth", "one_liner": "Runtime authorization per tool call, scoped by a mission that captures user and business intent and enforced outside the agent at an egress proxy, is what lets enterprises give agents more autonomy. Coarse OAuth scopes and blunt rate limits fail in agent cases like the Resy incident, where an eager agent made 200 API calls an hour and got its user banned.", "summary": "Keycard, JPMorgan Chase and the AAuth founder (co-creator of OAuth) argue in this panel that agents are held back by coarse, human-era authorization. OAuth scopes were built for pre-registered website-to-website access, so they are far too broad for agents whose needs aren't known in advance. The panel proposes intent-based runtime authorization as the fix. It has four parts: an AAuth 'mission' that tracks a task end to end, deterministic baseline policy intersected with per-task intent, a separate supervising agent, and budgets in place of rate limits. They tie it to agentic commerce, agent identity on the open web, a 'brains vs hands' sandbox with an egress-proxy authorization boundary, and a tamper-resistant audit log for liability and forensics.", "key_points": [ "Most enterprise systems are coarse-grained. Salesforce for a long time had a single OAuth scope, 'api', and Notion's MCP server can fetch a whole page but not just one database on that page.", "OAuth was designed so one website could talk to another. It expects pre-registration and a browser redirect, and mapping existing OAuth scopes onto agents is 'far too coarse grain'.", "AAuth's 'mission' is the big-picture task a person (a human or an organization) gives the agent, usually negotiated like a plan. A mission identifier follows every action, so all decisions can be audited in the context of that one mission.", "Keycard's model sets broad deterministic policy for what must never happen and what always needs a human. It then intersects the business's intent (why it adopted the agent, e.g. Claude Code) with the transactional intent (e.g. fix a bug in staging), and brings the user in only when absolutely required, to avoid consent fatigue.", "The Resy incident: an Instinct agent trying to book a restaurant made 200 API calls an hour and got the user's Resy account banned. AAuth adds budgets alongside time-limited tokens and gives the agent continual feedback on consumption. When the budget runs out, the supervisor decides whether to grant more, unlike rate limiting, which just cuts the agent off.", "In the 'brains vs hands' architecture the model sits in a sandbox with no standing credentials or API keys, and an egress proxy outside it acts as the authorization boundary. Ian describes this as the main model Anthropic, OpenAI and other labs are pursuing.", "Davis (JPMorgan Chase) recommends onboarding agents the way you onboard developers, adding capability as they mature. He also recommends removing tools dynamically to prevent toxic combinations, e.g. disabling web search and other egress tools while an agent is writing an email. Fewer available actions also lowers error rates and token spend.", "Keycard published a secure software factory reference architecture on agentbaseline.org with three levels: human-driven, workflow-driven and agentic-driven. Runtime authorization is a core component of it." ], "takeaways": [ "Authorize each tool call at runtime with the mission and intent context attached, instead of giving agents broad standing access or reused OAuth scopes.", "Keep credentials out of the agent. Run it in a sandbox and enforce authorization, and keep a tamper-resistant audit log, at an egress proxy outside the agent's control.", "Give agents budgets with continual feedback instead of hard rate limits, so a goal-seeking agent can pace itself and a supervisor can choose to extend the budget.", "Layer deterministic 'never/always ask a human' policy under per-task intent, and add or remove tools dynamically, so humans are pulled in only when it matters.", "Bring in environmental signals beyond intent, such as patch state, vulnerabilities, location and time, and consider attaching intent and that context to OTel spans for forensics." ], "topics": [ "agent authorization", "intent-based auth", "oauth", "agent identity", "agentic commerce", "runtime authorization", "sandboxing", "audit logging" ], "tools": [ "Keycard", "JPMorgan Chase", "AAuth", "OAuth", "MCP", "Notion", "Salesforce", "Resy", "Instinct", "Muse", "Grokbot", "Sierra", "Decagon", "Personal Agent Protocol", "Claude Code", "ChatGPT", "Vercel", "Squid proxy", "Hugging Face", "Anthropic", "OpenAI", "OIDC", "TLS", "OpenTelemetry", "Firefox", "eBay", "PocketOS", "agentbaseline.org" ], "quotes": [ { "text": "that agent was very eager. It made 200 API calls an hour and it ended up getting the user's resi account banned.", "at": "25:13", "url": "https://www.youtube.com/watch?v=IavxrdVnwXM&t=1513s" }, { "text": "When it was predetermined software, you know, that was a bug if you called 200 times and you would fix it. Um, where now, well, the agent's like, well, I'll just keep trying until I win.", "at": "25:36", "url": "https://www.youtube.com/watch?v=IavxrdVnwXM&t=1536s" }, { "text": "banks moved long ago from authorizing and authenticating humans to authorizing the transaction", "at": "05:45", "url": "https://www.youtube.com/watch?v=IavxrdVnwXM&t=345s" }, { "text": "they can just be unplugged but I think it's just true. It's like at the end of the day like they you can just they're computers we can unplug them.", "at": "42:23", "url": "https://www.youtube.com/watch?v=IavxrdVnwXM&t=2543s" } ], "words": 10647 }, "summary_url": "/#IavxrdVnwXM", "transcript": { "html": "/transcripts/IavxrdVnwXM.html", "txt": "/transcripts/IavxrdVnwXM.txt", "vtt": "/transcripts/IavxrdVnwXM.vtt" } }