Your Agent Just Authorized What?! — Jay Mok & Ben Coumes, Paypal

AI Engineer · 16 min · 165 sentences · from YouTube's caption track

Each timecode opens YouTube at the start of that sentence. Line anchors (#s42) are the cue ids in the WebVTT, and every line carries its start and end seconds. All transcripts has every talk, and the whole corpus as one file.

  1. 00:01[music]
  2. 00:12Hello everybody.
  3. 00:13How are you doing?
  4. 00:15Um Does anybody remember the movie Terminator?
  5. 00:20Uh anyways, it's one of my favorite uh movies when I was growing up as a kid.
  6. 00:24And it imagines a world where the machines have taken over, right?
  7. 00:29And uh uh the nightmare scenario here though in in 2026 is not that the machines are or the agents are launching nukes, but rather uh they've uh taken your wallet
  8. 00:42and they've gone on a shopping spree.
  9. 00:44And they buy like a bunch of crypto and new bunch of bunch of spanks for you.
  10. 00:50Um but the basically today we're talking about how we safeguard against that and uh and uh hopefully we can kind of share a a mental model that you can use when you're thinking about agent authorization.
  11. 01:04Uh my name is uh Jay Mock.
  12. 01:05I'm a product manager over at PayPal in agentic payments.
  13. 01:10And
  14. 01:11Hi everyone.
  15. 01:12I'm Ben Cooms.
  16. 01:12I am a staff software engineer on the payment PayPal enterprise payments team.
  17. 01:18And together we're going to share kind of like some knowledge with you.
  18. 01:21Um so hopefully uh you find it helpful.
  19. 01:25Okay.
  20. 01:26So uh the the key questions that we kind of like uh start off with is uh in terms of like agent authorization is uh did the human authorize this?
  21. 01:36Um is this allowed right now in this scope and can we prove it later, right?
  22. 01:42And we we kind of like try to make it general, but in our world of payments, yeah, did the human authorize this?
  23. 01:48Uh that could be like a passkey or of of that nature.
  24. 01:52Uh is this allowed right now in this scope?
  25. 01:54It's generally going to be a time bound um you know you know token.
  26. 01:59Um and an amount and possibly could be identified like a merchant or a the actual product intent.
  27. 02:08Lastly, can we prove it later?
  28. 02:11This is like if something goes wrong, right?
  29. 02:14And in our world of payments it's generally has to do with like the disputes and in that case and how do you can you prove that you know the the human generally authorized that transaction.
  30. 02:25Right?
  31. 02:26Um But we think the way that you actually answer these three questions is really dependent on the context.
  32. 02:34You know, context is a overused term, but in this case what we what we mean is um you know, is it a low stakes or high stakes kind of
  33. 02:45scenario?
  34. 02:47Um and is this a kind of like open ecosystem or closed ecosystem?
  35. 02:54Do the parties like know each other?
  36. 02:55You know, people use the term KYA a lot.
  37. 02:58Know your agent, but you know, what we think about in this scenario is is is really about is it like an open or closed ecosystem, right?
  38. 03:06And in a payments context it could be like, "Hey, you know, ChatGPT or Gemini, right?"
  39. 03:11That's like kind of like a more of like a closed ecosystem because you know, the those agents know the merchant generally.
  40. 03:18Um I like to use a an analogy.
  41. 03:23I like analogies.
  42. 03:24And the analogy I I like to use is kind of like the you know, badging into work.
  43. 03:29You badge into work in the front desk.
  44. 03:31You basically are are then led into the building or you know, let's say it's a set of buildings.
  45. 03:37You don't need to like badge in every single time to every other or for every single room because you're already within that trusted boundary, right?
  46. 03:45So then when you meet someone in within that within your your office building, uh, you kind of have some element of trust, or hopefully you have some element of trust,
  47. 03:54uh, because you're both, uh, employees at the same company that badged in, right?
  48. 03:58So, um, that's kind of like the analogy I may I may use later in the presentation.
  49. 04:05Okay, so based on those key questions, we kind of think about like, "Hey, what's the mental model that we can build off of this, right?"
  50. 04:11And we have this like stakes and evidence matrix, and we're going to talk about, uh, these three different scenarios.
  51. 04:17Um, and so, uh, we're going to first uh, and you'll see at the top it's kind of like the stakes and counterparty part that I was just talking about the context,
  52. 04:25right?
  53. 04:25Counterparty is like the open or closed ecosystem.
  54. 04:28And then authority and like evidence is really about how you answer those those those three questions I had shared in in the prior slide, right?
  55. 04:36Um, so we'll talk a little bit first about like cloud code since that's what most people are very familiar with, and, uh, basically, you know, when you as a human you're going, you know, using your cloud code,
  56. 04:46uh, you know, you might be, uh, then setting up, uh, your your connectors with your GitHub or or, um, you know, Jira or whatever, uh, linear or whatever uh, tool you're using.
  57. 04:56And, um, you know, you're as part of that process you're kind of like authenticating, so that's how you kind of like get that that human authorization and consent um, with those those applications
  58. 05:06and to for the for cloud container act with them.
  59. 05:09Um, in terms of the, uh, actual like, uh, scopes, right?
  60. 05:14The the example here would be that about, you know, cloud's like, uh, tool permissions.
  61. 05:19Like people are very familiar probably with, uh, the fact that you can allow cloud cloud to to use certain tools, um, uh, deny or ask cloud to ask you,
  62. 05:28uh, before for before doing something, right?
  63. 05:32And then in terms of, uh, the action of like a cloud, uh, we generally think, um, because it's a kind of closed ecosystem and it's like you're coding, uh, the stakes are relatively low here.
  64. 05:43And so in terms of the evidence or proof, you don't really need to have like that cryptographic proof um, at that point in time.
  65. 05:49You can kind of just look at like system logs in order to to or you have the ability to just revert revert your changes, right?
  66. 05:57So, that's kind of like an example of applying like this mental model and using cloud code in terms of that scenario.
  67. 06:07Okay, so the next example we're going to talk about is a more medium stakes scenario and why why we're calling this medium stakes even though it's within a known or kind of closed ecosystem is because it has to do with money
  68. 06:21and and payments.
  69. 06:23And so that's like the shared vault and OAuth scope example.
  70. 06:29So, in this example where the use case is is like hey you're like a let's say a merchant or Trip Advisor, right?
  71. 06:38And you have a travel travel company and you have a lot of great content that you want to monetize.
  72. 06:45It could be occupancy data, it could be like reviews, what have you.
  73. 06:48And you have a new customer now.
  74. 06:50You have like a trap like travel agents or like you know agents that that are buyer agents that are are coming to you and you want to be able to
  75. 06:59monetize monetize your data, right?
  76. 07:02Through machine payments.
  77. 07:04So, we work with a partner and Never mind to be able to enable that that that use case and leveraging our they're leveraging our infrastructure.
  78. 07:15Right?
  79. 07:15So, there is two pieces of infrastructure that they that I like to kind of to call out or primitives that they use that as part of the Braintree or PayPal enterprise
  80. 07:26infrastructure.
  81. 07:27One is like the vault, right?
  82. 07:28And the vault by itself, which is storing all these like payment credentials on behalf of the on behalf of the buyer agents, on itself doesn't really do much, but in order to create
  83. 07:42what nevermind creates is a a more eco closed ecosystem, they then off you're able to um offer uh or offer access to those payment credentials through OAuth, right?
  84. 07:58To all those merchants.
  85. 07:59So, in our example before we talked about that that travel travel um travel company, right?
  86. 08:06So, by doing so, they're able to then create like an ecosystem um of buyer agents and seller agents uh and have a more trusted environment, right?
  87. 08:17So, um in the in the just kind of talking more about the use case, like the human then is then going to be authorizing authorizing their their payment.
  88. 08:28Usually, this is a commercial card commercial use case.
  89. 08:31So, you're using like a commercial card, they share it with the buyer agent, travel agent.
  90. 08:36Um then that uh it it also has scopes associated with that mandate.
  91. 08:43So, that's how you're able to do controlled authority, but in terms of like the actual like dispute handling, we really uh don't have like a we're not using like
  92. 08:54cryptographic proof that's being sent as part of that that request, right?
  93. 08:58At the end of the day, they can since it's more of a closed ecosystem, they're able to leverage like the just the existing transaction logs.
  94. 09:09Right?
  95. 09:09So, that's kind of an example of like a medium stakes and use case or scenario, and we we believe it's medium stakes because of the fact that it is a more closed ecosystem
  96. 09:23and doesn't require all like the you know, evidence in terms of or proof, right?
  97. 09:33So, that's kind of like my part.
  98. 09:35I'll going to turn it over now to Ben and uh take it from here.
  99. 09:40Uh thanks, Jay.
  100. 09:43Yeah, so the last slide that Jay talked about, um you know, we're kind of going over the medium stakes example.
  101. 09:50Uh um In that scenario, um you know, both parties know each other.
  102. 09:56Uh they're acting within, you know, the same system.
  103. 09:59They they know you know, they're borrowing trust from, you know, Nevermind to make sure that, you know, the buying agent is falling within, you know, the instructions that a human has given it.
  104. 10:11Um and then the selling agent that's also on Nevermind can feel comfortable taking a payment um from another user of of Nevermind.
  105. 10:19And And so, what we want to talk about next is what happens when the parties are are not known to each other and they're not vetted.
  106. 10:26Um And so, like we think, you know, we believe that the best option for that, you know, is actually do these autonomous payments, um where, you know, you know, not everyone's known.
  107. 10:38Like you know, the stakes are high.
  108. 10:40You know, we think that the industry should converge on the FIDO verifiable intents and AP2 mandate.
  109. 10:47Um You know, the TLDR of that is, you know, it's a a multi-layered selective disclosure jot.
  110. 10:53Uh The first layer is, you know, created by a trustworthy credential provider.
  111. 10:58You know, in this case, hopefully it would be PayPal.
  112. 11:01Um The second layer, you know, encapsulates the user's instructions to the agent.
  113. 11:05Um The user signs that with their private key.
  114. 11:09And then the third layer, if there's going to be a third layer, is when um we're doing autonomous payments.
  115. 11:15So, that case, the agent would, you know, sign that third layer.
  116. 11:19And And so, the where that's powerful is that, you know, party involved in a transaction can can verify the part that's, you know, important to them.
  117. 11:30So, merchants can verify that the checkout is correct.
  118. 11:34Um Um payment processors can verify that the payment mandate is correct.
  119. 11:38Um And no one has to have any relationship to each other.
  120. 11:42Um And so, like I think, you know, if there's going to be a ton of payments, you know, at scale, we think that that's going to be the best
  121. 11:50um way to accomplish it.
  122. 11:52Uh pictures on the screen are depicting our PayPal approval token.
  123. 11:57Um This is a new primitive that allows users of PayPal to basically start the order process with an agent um for that agent has actually found an item at a merchant to transact with.
  124. 12:10Uh historically, PayPal orders have been synchronous.
  125. 12:14Um You know, users on checkout, they find their item, they go to their PayPal app, they approve it, um and it's done.
  126. 12:22Uh here, it's a little bit different, you know.
  127. 12:24Users on their agent, um they get redirected to PayPal to confirm the instructions that are given to the agent, and then uh PayPal hands back this JSON payload.
  128. 12:35Um you know, similar to the verifiable intent, uh includes the amount, the expiry, uh the merchant that is supposed to be transacted with.
  129. 12:44Um Similar concept, but not quite the same.
  130. 12:47Um it's an opaque string that only PayPal can approve right now.
  131. 12:52But we're about to ship this into production, um and users of Jet and I that pick PayPal as a payment method will will use this.
  132. 13:02Um so, going to our last slide, um you know, we showed this slide earlier.
  133. 13:07It we didn't have the two columns filled out on the right-hand side.
  134. 13:10Um You know, we wanted to reinforce this mental model where, you know, starting at the top, we have, you know, the low-stakes scenario, you know, you're you're using Claude, you've given it access to connectors, you know, granular permissions to do things on your behalf.
  135. 13:24Um you feel comfortable doing that because the stakes are low.
  136. 13:27You know, you can reverse those actions or redo them.
  137. 13:29It's not a big deal if Claude produces, you know, the wrong output.
  138. 13:33Uh going down a level, we have the medium stakes scenario.
  139. 13:36You have two parties that know each other that are acting within the same system's boundary.
  140. 13:42Um you know, the the actions are a little bit higher stakes.
  141. 13:44You know, there is money movement here, but both parties can can feel comfortable, you know, transacting with each other because they're relying on this this third party to enforce
  142. 13:54uh the payment mandate.
  143. 13:56And then the third level, you know, the highest stakes one um that we haven't actually really seen in production yet, it's, you know, the user's giving an agent some
  144. 14:05instructions to do something on their behalf autonomously, and you don't know who they're going to interact with, who they're going to transact with.
  145. 14:11Um and those parties need some verifiable proof that the agent has permission to do the transaction.
  146. 14:17And so, we believe that that will be um either verifiable dents and and AP2 mandates.
  147. 14:24Um I think the interesting thing is it's also our belief that, you know, this is a model that can't won't just be used for payments, but we think it could be for
  148. 14:34any sort of high-stakes action that's hard to reverse.
  149. 14:36So, medical orders, e-signatures, securities trading, um you know, basically any hard-to-reverse agent action.
  150. 14:45That's all I have.
  151. 14:46Yeah, I mean, I think um if we could just go back to analogies, uh you know, like in the low stakes is kind of like, "Hey, you're within the the building.
  152. 14:54You've uh put a badge in and you're within the building."
  153. 14:56Whereas in the um high stakes is kind of like, "You are on the street and you meet somebody."
  154. 15:02And uh you know, you need a way to be able to uh get comfort that that's someone you can trust, right?
  155. 15:09Um is a badge is them showing you their badge good enough?
  156. 15:13Uh probably not.
  157. 15:14You need to have something that's a little bit more um you know, verify verifiable.
  158. 15:19Or I guess at a verifiable standard.
  159. 15:21So, um you know, just kind of like using that analogy and like how to think about like the you know, what you need to do in order to prove the that the human authorized the agent.
  160. 15:34Hopefully that that helps and now you have kind of like a tool set to use.
  161. 15:39So you can kind of prevent Skynet from taking over your wallet.
  162. 15:43So, thank you very much for your for listening.
  163. 15:45Hope that helps.
  164. 15:49[applause]
  165. 16:04[music]