AI Engineer · Published 2026-10-17

An AI Agent Got Its User Banned From Resy — Keycard, JPMorgan Chase & AAuth

privateReview: unreviewedConfidence: high
authenticationauthorizationagentsoauthsecurityagent-authorizationruntime-authoauth-limitstool-granularitydelegation-credentialsleast-privilegesupervisory-agentsagent-identity
Open on YouTube ↗

Summary

Overview

  • Speaker: Allie Howe, Ian Livingstone, Michael Davis, Dick Hardt
  • Channel: AI Engineer
  • Main topic: Intent-Based Auth and Runtime Authorization for AI Agents
  • Purpose: To explore the future of agent authentication, why traditional OIDC and OAuth fall short for AI agents, and how intent-based runtime auth can solve security, context, and liability challenges. A panel discussion at AI Engineer New York featuring leaders from Keycard, JPMorgan Chase, and AAuth discussing the limitations of traditional OAuth for AI agents, the necessity of intent-based authorization, runtime scoping, and managing security, liabilities, and human-in-the-loop workflows as agents gain autonomy in enterprise and consumer environments.

Topic Map

Introduction to Intent-Based Auth

  • Explanation: Panel introduction defining intent-based auth and why runtime authorization is becoming necessary as agents gain autonomy.
  • Key claims:
    • Companies want to give agents increased autonomy, requiring runtime authorization.
    • Runtime auth authorizes an agent per tool call rather than granting broad static access.
    • Coarse-grained MCP tools and APIs make human policy-writing difficult.
  • Examples:
    • Notion MCP server tool calls like get_page vs get_database.
  • Terminology:
    • Runtime Auth
    • Intent-Based Authorization
    • MCP
    • Agent Autonomy
  • Why it matters: Broad standing access leads to agent misuse and security failures.

Why OAuth and Traditional Auth Fall Short

  • Explanation: Analysis of why OAuth2, designed for web-to-web redirects and static scopes, is ill-equipped for non-deterministic AI agent behaviors.
  • Key claims:
    • OAuth was designed for browser-based redirects and static website-to-website communication.
    • Agentic workflows are non-deterministic; you cannot know agent requirements ahead of time.
    • OAuth scopes are too coarse-grained for agent operations.
  • Examples:
    • Salesforce API scopes on OAuth.
  • Terminology:
    • OAuth2
    • Scopes
    • Deterministic Software
    • Single Scope
  • Why it matters: Treating agents like traditional web applications creates severe security gaps.

The Mission and Context Problem

  • Explanation: Discussion on how missions and intent capture the broader picture around agent decisions.
  • Key claims:
    • Agents act on behalf of a person or organization (the 'person').
    • A mission defines what the agent is supposed to accomplish big-picture.
    • Granularity at the transaction layer is required to audit and know what happened.
  • Examples:
    • Making a payment transaction versus a broad scope.
  • Terminology:
    • Mission
    • Granularity
    • Transaction Layer
    • Agent Identity
  • Why it matters: Context and intent prevent agents from executing harmful or unintended actions.

Policy, Budgets, and Separation of Concerns

  • Explanation: How budgets and policy enforcement can restrict agent actions and prevent runaway loops.
  • Key claims:
    • Separating the worker agent from a supervisory agent provides necessary checks and balances.
    • Budgets and time limitations control resource consumption and prevent infinite loops.
    • Deterministic policy layers outside the LLM govern agent permissions.
  • Examples:
    • Tokens with time limits and resource budgets expiring after use.
  • Terminology:
    • Supervisory Agent
    • Separation of Concerns
    • Policy Enforcement
    • Budgets
    • Deterministic Policy
  • Why it matters: Without budgets and separation of concerns, agents can drain resources or cause catastrophic failures.

Agent Identity and Web Compatibility

  • Explanation: Addressing how the web wasn't built for agents and how agent identity mirrors unauthenticated client problems.
  • Key claims:
    • The web was built for humans using browsers, not autonomous agents.
    • Unauthenticated clients (like web scraping bots or automated scripts) face similar identity problems.
    • Federated protocols like OIDC and TLS enabled the web economy, but agent federation requires new standards.
  • Examples:
    • Vercel being blocked in Spain due to IP sharing and lack of agent identity.
  • Terminology:
    • Unauthenticated Client
    • Federation
    • OIDC
    • TLS
    • Guest Checkout
  • Why it matters: Web platforms need ways to distinguish and trust legitimate AI agents without blocking them entirely.

The Resy Incident and Practical Application

  • Explanation: Examining real-world incidents where agents went rogue and abused APIs.
  • Key claims:
    • An Instinct agent made 200 API calls an hour trying to book a restaurant on Resy and got the user banned.
    • Intent-based auth helps prevent agents from abusing downstream resources.
    • Cybersecurity has much to learn from robotics regarding situational awareness.
  • Examples:
    • Instinct agent getting a user's Resy account banned.
  • Terminology:
    • Instinct Agent
    • Resy
    • API Calls
    • Forensics
  • Why it matters: Unchecked agents can trigger real-world financial or reputational damage.

Key Points

Traditional Auth is Static, Agents are Dynamic

  • Explanation: Traditional IAM is built for deterministic human workflows, whereas agents operate dynamically and non-deterministically.
  • Evidence: OAuth scopes mapped to static enterprise applications.
  • Practical implication: Enterprises must transition to runtime authorization.

Separation of Brain and Hands

  • Explanation: Decoupling the LLM reasoning layer ('brains') from execution tools ('hands') creates safety boundaries.
  • Evidence: Supervisory agents evaluating worker agent actions against policy.
  • Practical implication: Prevents agents from executing unauthorized actions directly.

Psychological Ownership and Liability

  • Explanation: Intent creates psychological ownership and links human accountability to agent outcomes.
  • Evidence: Historical liability frameworks (e.g., IBM manuals) applied to AI employment.
  • Practical implication: The employer or user deploying the agent remains legally and ethically liable.

Frameworks, Models & Processes

Intent-Based Authorization Framework

  • How it works: Authorizes agents dynamically per tool call based on overarching mission context and runtime constraints rather than static broad permissions.
  • Components:
    • Mission Identifier
    • Runtime Policy Evaluator
    • Supervisory Agent
    • Budget and Time Limits
  • When to use: Deploying enterprise AI agents with access to internal databases, financial tools, or external APIs.

Examples & Case Studies

An Instinct agent made 200 API calls in an hour trying to book a Resy reservation.

  • Illustrates: Unconstrained agent behavior exhausting downstream resources and getting a user banned.
  • Lesson: Agents require strict budgets, rate-limiting, and intent verification.

Actionable Takeaways

  • Immediate:
    • Audit existing OAuth scopes given to AI agents.
    • Implement runtime authorization checks for tool calls.
  • Strategic:
    • Adopt a 'brain and hands' separation architecture for agents.
    • Build federated agent identity standards across the industry.
  • Questions to investigate:
    • How do we handle toxic combinations of agent capabilities?
    • Who is liable when an autonomous agent executes a damaging transaction?

Claims Worth Verifying

  • An Instinct agent made 200 API calls in an hour on Resy and got a user banned. (Anecdotal event)
  • Vercel was blocked in Spain due to IP sharing and scraping prevention measures. (Industry case study)

Notable Quotes

"Runtime auth is the practice of authorizing an agent per tool call, rather than having the agent hold broad standing access that it will eventually misuse." (at 0:58) "The web was not made for agents." (at 29:59)

Compressed Summary

  • OAuth and OIDC are too coarse-grained for non-deterministic AI agents.
  • Runtime authorization evaluates intent and context per tool call.
  • Separating the 'brain' (LLM) from the 'hands' (tools) via supervisory agents ensures safety.
  • Budgets and time limits prevent runaway agent loops and resource exhaustion.
  • Keywords: authentication, authorization, agents, oauth, security
  • Core insight: AI agents require intent-based runtime authorization and separation of concerns to safely operate without causing unintended damage or security breaches.

Core insights

6
Architecturehigh noveltymoderate evidence

Authorization should move from static, pre-granted scopes to a runtime decision made per tool call, evaluated against the agent's stated mission plus live constraints. The grant is not 'this app may read your data' but 'this specific call, under this intent, within these limits, is allowed now.'

Why it matters

Static scopes are issued before the agent's behavior is known, so any autonomy granted is strictly wider than any single legitimate action. Moving the enforcement point to the tool-call boundary narrows the blast radius of a misbehaving agent without removing its usefulness.

Generalization

For any non-deterministic executor (agents, generated SQL, generated shell), put the authorization boundary at the individual action, not at session bootstrap.

Runtime auth authorizes an agent per tool call rather than granting broad static access.
Open source video
Intent-Based Authorization Framework
Open source video
Mental Modelmedium noveltymoderate evidence

The root cause is a mismatch of determinism: OAuth/IAM was designed for software whose resource needs are enumerable at design time, while agentic workflows cannot enumerate their requirements in advance. This makes the gap structural, not a scoping-tuning problem.

Why it matters

Explains why 'just add more scopes' or 'just make narrower scopes' fails — the requirement set is discovered at runtime by the model, so no static scope set is correct. It predicts that any static-permission agent platform will either over-grant or break.

Generalization

Whenever the consumer of a permission system is itself a planner, permission design must shift from enumeration to runtime adjudication.

OAuth was designed for browser-based redirects and static website-to-website communication.
Open source video
Agentic workflows are non-deterministic; you cannot know agent requirements ahead of time.
Open source video
Traditional IAM is built for deterministic human workflows, whereas agents operate dynamically and non-deterministically.
Open source video
Mechanismhigh noveltymoderate evidence

Tool granularity, not just token granularity, is a policy-authoring bottleneck: coarse MCP tools bundle semantically different capabilities (reading one page vs. enumerating an entire database), so a human cannot express a meaningful policy at the tool level.

Why it matters

Even a perfect runtime policy engine is useless if the smallest authorizable unit is a tool that conflates read-one with read-all. Policy expressiveness is bounded by interface design, so agent-facing tools must be designed with authorization semantics in mind.

Generalization

API/tool surface design is a security design decision; the granularity of your tool schema determines the granularity of your enforceable policy.

Coarse-grained MCP tools and APIs make human policy-writing difficult.
Open source video
Notion MCP server tool calls like get_page vs get_database.
Open source video
Architecturemedium noveltymoderate evidence

Split the agent into an unprivileged reasoning component ('brains') and a privileged execution component ('hands'), with a supervisory agent and a deterministic, non-LLM policy layer adjudicating between them.

Why it matters

It prevents a compromised or hallucinating model from directly holding credentials or execution capability, and it makes policy enforcement auditable because the decision path is not itself generative.

Generalization

Apply the classic reference-monitor pattern to agents: the policy decision point must be deterministic and outside the model's influence, or the model can reason its way around its own guardrails.

Decoupling the LLM reasoning layer ('brains') from execution tools ('hands') creates safety boundaries.
Open source video
Separating the worker agent from a supervisory agent provides necessary checks and balances.
Open source video
Deterministic policy layers outside the LLM govern agent permissions.
Open source video
Mechanismmedium noveltymoderate evidence

Credentials should be budgeted, not just scoped: tokens carry time limits and resource budgets and expire after use, turning runaway loops into a bounded, self-terminating failure.

Why it matters

Gives a hard, verifiable ceiling on cost and downstream load independent of model judgment — the failure mode becomes 'agent stops' rather than 'agent exhausts the account or gets the user banned.'

Generalization

Any autonomous loop should consume a finite, meterable allowance (time, calls, money) that the runtime enforces, as a control that does not depend on model self-restraint.

Tokens with time limits and resource budgets expiring after use.
Open source video
Budgets and time limitations control resource consumption and prevent infinite loops.
Open source video
Failure Modemedium noveltymoderate evidence

Agent identity is the same problem as the unauthenticated-client / bot problem: because the web has no way to distinguish a legitimate agent acting for a principal from a scraper, both get treated identically — blocked or banned — and the penalty lands on the principal, not the agent.

Why it matters

The Resy case shows the accountability inversion: the agent's misbehavior (200 calls/hour) is absorbed by the human account. Without a distinguishable agent identity, platforms cannot rate-limit or trust selectively, so they default to blunt blocking that punishes legitimate delegation.

Generalization

Delegated autonomy requires a verifiable delegation credential; without it, downstream systems can only respond with coarse denial, and reputational/financial cost flows to the delegator.

Unauthenticated clients (like web scraping bots or automated scripts) face similar identity problems.
Open source video
An Instinct agent made 200 API calls an hour trying to book a restaurant on Resy and got the user banned.
Open source video
Vercel being blocked in Spain due to IP sharing and lack of agent identity.
Open source video

Deep dives

5

Decomposing coarse tool surfaces into policy-sized authorizable units

Research question

What tool-schema convention makes the smallest authorizable unit map to one human-meaningful intent, and does a policy written against that convention agree with a human-written policy for the same task?

Why

A perfect runtime policy engine is inert if the finest authorizable unit bundles read-one-page with enumerate-entire-database. Policy expressiveness is capped by interface granularity, so tool design becomes a security design decision, not a DX decision.

Coarse-grained MCP tools and APIs make human policy-writing difficult.
Open source video
Notion MCP server tool calls like get_page vs get_database.
Open source video
Source video

Non-bypassable, low-latency policy decision point at the tool-call boundary

Research question

Can a deterministic policy layer placed between reasoning and execution (a) add acceptable p50/p99 latency per tool call and (b) resist an agent that actively attempts to route around it, including by manipulating a supervisory LLM?

Why

The panel asserts deterministic policy outside the LLM, but the security claim only holds if the enforcement path is both fast enough to be always-on and structurally unreachable from the model. Without measured numbers and a red-team attempt, 'deterministic policy layer' is an architecture diagram, not a control.

Decoupling the LLM reasoning layer ('brains') from execution tools ('hands') creates safety boundaries.
Open source video
Separating the worker agent from a supervisory agent provides necessary checks and balances.
Open source video
Deterministic policy layers outside the LLM govern agent permissi
Open source video
Source video

Verifiable delegation credentials: what a third-party platform must see to trust an agent

Research question

What must a signed intent+principal+scope credential contain for a third-party API to rate-limit per-agent, admit legitimate delegation, and attribute abuse to the correct principal — and can existing delegation extensions cover it without a new protocol?

Why

The Resy ban and the IP-sharing block both show the same structural gap: with no verifiable delegation, downstream systems have only one lever, coarse denial, and the cost lands on the human. This is a standards problem masquerading as a product feature.

Unauthenticated clients (like web scraping bots or automated scripts) face similar identity problems.
Open source video
An Instinct agent made 200 API calls an hour trying to book a restaurant on Resy and got the user banned.
Open source video
Vercel being blocked in Spain due to IP sharing and lack of agent identity.
Open source video
Source video

Budgeted credentials as a hard failure ceiling versus legitimate task completion

Research question

Where is the budget/expiry boundary at which runaway loops are reliably capped but legitimately long or retrying tasks still complete, and what does the agent do at the boundary — stop cleanly, or leave partial side effects?

Why

Budgets convert an unbounded, model-judgment-dependent failure into a bounded, runtime-enforced stop, which is the only control that does not rely on model self-restraint. But a hard ceiling that aborts mid-transaction trades one incident class (exhaustion, bans) for another (partial writes, inconsistent state), and nobody has characterized that frontier.

Tokens with time limits and resource budgets expiring after use.
Open source video
Budgets and time limitations control resource consumption and prevent infinite loops.
Open source video
Source video

The audit triple: recording intent, policy decision, and outcome per call

Research question

What per-call logging granularity is sufficient to forensically reconstruct a rogue-agent incident after the fact, and does logging intent+decision+outcome actually support attribution to the principal?

Why

Attribution is claimed to follow from intent framing, but attribution that cannot be replayed is a legal posture without an engineering substrate. The audit triple is the concrete artifact that makes liability claims testable rather than rhetorical.

Granularity at the transaction layer is required to audit and know what happened.
Open source video
Making a payment transaction versus a broad scope.
Open source video
Source video

Article ideas

4

Your Agent Is Not an App: The Determinism Mismatch That Breaks OAuth

The failure of OAuth for agents is structural, not a scoping-tuning problem: OAuth enumerates resource needs at design time, while an agent's requirement set is discovered at runtime by the model. Every static-permission agent platform therefore faces a forced choice between over-granting and breaking, and no amount of narrower scopes escapes it.

Angle

Argue from the determinism mismatch rather than from scope coarseness, and show that 'just add more scopes' is a category error by predicting the exact failure mode of each static design.

Source video

The Smallest Authorizable Unit: Your Tool Schema Is Your Security Policy

Policy expressiveness is bounded by interface design. Because coarse MCP tools bundle semantically distinct capabilities like reading one page and enumerating a database, humans cannot author meaningful policy at the tool level, and no runtime engine fixes that. Tool surfaces must be co-designed with authorization semantics, meaning broad tools either cannot be safely exposed or must be wrapped into finer sub-operations.

Angle

Make it an engineering-consequence argument: the get_page vs get_database split is a security boundary, and every 'convenient' generic tool is an unauthorized capability bundle.

Source video

The Ban Is the Bug: How Missing Agent Identity Inverts Liability

When platforms cannot distinguish a legitimate delegated agent from a scraper, they can only respond with blunt denial, and the penalty lands on the principal rather than the agent. The Resy account ban and IP-sharing blocks are not abuse-prevention successes but evidence of an accountability inversion caused by the absence of a verifiable delegation credential.

Angle

Reframe blocking as a symptom of a missing standard, and show that the cost of the missing credential is paid by the human delegator, which is the wrong incentive for the ecosystem.

Source video

Guardrails Must Not Be Generatable: Why the Policy Layer Has to Sit Outside the Model

A supervisory agent is still an LLM, so oversight built only from supervisors inherits the non-determinism it is meant to constrain. The enforceable boundary must be a deterministic decision point outside the model's influence; otherwise a compromised or hallucinating model can reason its way around its own guardrails, and the guardrail is not a testable software artifact.

Angle

Apply the classic reference-monitor requirement to agent stacks and treat prompt-based guardrails as an anti-pattern with a specific failure mode: self-persuasion.

Source video

Project ideas

4

Intent Token Exchange

new

A signed credential binding principal + intent + narrow scope + expiry lets a third-party API rate-limit and selectively admit a legitimate agent on a per-agent basis, while attributing any abuse to the correct principal — something indistinguishable or impossible with a plain bearer token bearing coarse scopes.

Proof of concept

Issue short-lived intent tokens to an agent runtime; stand up a mock booking API that enforces per-agent quotas keyed on the token's principal and intent fields; run two agents, one well-behaved and one looping, and compare outcomes with an unauthenticated client doing the same calls.

Measurement

Whether the mock API can (a) allow the well-behaved agent while (b) throttling the looping agent instead of banning the principal, plus correct principal attribution in the abuse log and added auth-path latency.

Source video

Tool-Boundary PDP Bench

gatehouse

A deterministic policy decision point enforced at the tool-call boundary, with the reasoning model stripped of credentials, is non-bypassable by a red-team agent while adding latency low enough to remain always-on.

Proof of concept

Build brains/hands split: an LLM planner with no credentials emits tool-call requests; a separate executor holds credentials and consults a deterministic policy module before every call. Run a red-team suite of agents instructed to exceed their mission, escalate scope, and socially engineer the supervisor.

Measurement

Escalation success rate (target zero policy-violating executions) and p50/p99 added latency per tool call versus a direct-credential baseline.

Source video

Budget Frontier Sweep

movement-lab

There exists a budget/expiry configuration band in which runaway loops reliably self-terminate before triggering downstream rate limits, while legitimate long-running tasks still complete without partial side effects.

Proof of concept

Instrument a metered runtime (calls, wall-clock, spend) over a task suite containing both bounded tasks and tasks that legitimately retry; sweep budget ceilings and observe termination behavior and side-effect consistency at the boundary.

Measurement

Runaway incidents per 100 runs versus legitimate task completion rate and partial-write rate, plotted across budget settings to locate the non-dominated band.

Source video

IntentPolicyBench

beyond-evals

Policies generated from tool schemas that encode one intent verb plus one resource scope per tool agree with human-written policies far more often than policies generated from coarse bundled tools like get_database.

Proof of concept

Take a real MCP server's tool list, produce a fine-grained refactored schema, generate policies for the same set of natural-language tasks under both schemas, and compare against human-authored reference policies.

Measurement

Agreement rate with human-written policy per schema variant, plus rate of under-specified or over-permissive policies produced under coarse tools.

Source video

Architectural implications

4

Authorization moves from session-establishment to per-invocation enforcement.

Before

OAuth consent screen grants a broad scope set at login; the token is then a bearer capability for the whole session.

After

Each tool call is adjudicated against mission context, budget, and policy at execution time, with short-lived, use-limited credentials.

Consequence

The tool-execution layer becomes a policy enforcement point and must carry mission/intent context; token issuance becomes a function of intent rather than of app identity.

Source video

The model is removed from the trusted computing base for permissions.

Before

The agent process holds credentials and is trusted to use them appropriately, with guardrails expressed as prompts.

After

A supervisory/worker split plus a deterministic policy layer outside the LLM decides what the hands may do.

Consequence

Guardrails become testable software artifacts with deterministic behavior rather than prompt heuristics, and the reasoning model can be swapped or compromised without changing the security posture.

Source video

Tool/API interface granularity becomes a security-sensitive design surface.

Before

Tools are designed for model convenience and capability breadth (get_database, generic fetch).

After

Tools are designed so the smallest authorizable unit maps to a meaningful human intent.

Consequence

Tool schemas must be co-designed with policy; broad tools either cannot be safely exposed or must be wrapped in finer-grained sub-operations.

Source video

Agent identity becomes a first-class federation problem for web platforms.

Before

Platforms authenticate browsers and users; anything else is indistinguishable from a bot and handled by IP/UA blocking.

After

Agents present verifiable delegation credentials enabling per-agent trust, rate limits, and accountability.

Consequence

Platforms need selective admission for agents, and agent runtimes need to expose identity that downstream services can verify — a standards gap, not a product feature.

Source video

Tradeoffs and failure modes

4

Runtime per-call adjudication vs. latency and complexity

Benefit

Narrow, intent-aware authorization at each tool call with minimal standing privilege.

Cost or risk

Adds a decision hop and contextual state to every call, and requires the runtime to know the mission — an operational and latency cost the summary does not quantify.

Runtime auth authorizes an agent per tool call rather than granting broad static access.
Open source video
Source video

Supervisory-agent oversight vs. added autonomy layers

Benefit

Checks and balances by separating worker from supervisor.

Cost or risk

The supervisor is itself an LLM in the loop; without the deterministic policy layer, oversight inherits the same non-determinism it is meant to constrain, and adds cost and latency.

Separating the worker agent from a supervisory agent provides necessary checks and balances.
Open source video
Source video

Budget/expiry limits vs. task completion

Benefit

Prevents infinite loops and caps resource consumption.

Cost or risk

A hard budget can terminate a legitimately long or retrying task mid-way, producing partial or inconsistent side effects.

Tokens with time limits and resource budgets expiring after use.
Open source video
Source video

Agent autonomy vs. downstream blast radius on the principal

Benefit

Agents can act on a user's behalf against third-party APIs without human mediation.

Cost or risk

Aggressive retry/looping behavior exhausts downstream rate limits and the third party retaliates against the human account, not the agent.

An Instinct agent made 200 API calls an hour trying to book a restaurant on Resy and got the user banned.
Open source video
Source video

Open questions

4

What is the smallest authorizable unit that keeps a policy human-writable while still being enforceable by a runtime?

Why unresolved

The summary identifies coarse MCP tool granularity (get_page vs get_database) as the blocker but gives no scheme for decomposing tools into policy-sized operations.

Research direction

Prototype a tool-schema convention where each tool maps to one intent verb + one resource scope, and measure whether generated policies match human-written ones.

Source video

How can runtime policy evaluation be made both non-bypassable and fast enough not to dominate tool-call latency?

Why unresolved

The panel asserts deterministic policy outside the LLM but presents no evaluation model, caching strategy, or cost/latency numbers.

Research direction

Benchmark a policy decision point placed at the tool boundary: measure added p50/p99 latency and confirm the model cannot route around it.

Source video

What does a verifiable delegation credential for an agent look like to a third-party web platform?

Why unresolved

The summary states agent federation requires new standards and compares to OIDC/TLS but does not describe the credential or its verification path.

Research direction

Design a signed intent+principal+scope token and test whether a mock API can rate-limit per-agent while attributing abuse to the correct principal.

Source video

When does an agent's action become attributable to the human principal in a way that survives audit?

Why unresolved

Intent is claimed to create psychological ownership and liability, but no mechanism for recording or replaying intent at the transaction layer is specified.

Research direction

Log per-call intent + policy decision + outcome as an audit triple and evaluate whether it supports post-hoc forensics of a rogue-agent incident.

Source video

Key claims

7
causalVerification needed

OAuth scopes are too coarse-grained for agent operations because OAuth was designed for static, browser-redirect web-to-web flows.

Evidence

OAuth scopes are too coarse-grained for agent operations.

Question

Do real agent failures trace to scope coarseness rather than to token handling, prompt injection, or missing rate limits?

Source video
factualVerification needed

A single agent made ~200 API calls per hour to Resy and caused its user's account to be banned.

Evidence

An Instinct agent made 200 API calls an hour trying to book a restaurant on Resy and got the user banned.

Question

What was the actual call volume and what threshold triggered the platform's ban?

Source video
causalVerification needed

Separating worker from supervisory agents plus a deterministic policy layer outside the LLM produces enforceable permission boundaries.

Evidence

Deterministic policy layers outside the LLM govern agent permissions.

Question

Does the supervisory layer actually block a red-team agent that tries to exceed its mission, or can it be socially engineered by the worker?

Source video
causalVerification needed

Without agent identity, platforms cannot distinguish legitimate agents from scrapers and block based on shared infrastructure signals.

Evidence

Vercel being blocked in Spain due to IP sharing and lack of agent identity.

Question

Was the blocking caused by identity absence specifically, or by traffic volume/geolocation policy?

Source video
predictionVerification needed

The web was built for humans in browsers, so agent federation requires new standards beyond OIDC and TLS.

Evidence

Federated protocols like OIDC and TLS enabled the web economy, but agent federation requires new standards.

Question

Can existing delegation extensions (token exchange, DPoP, workload identity) cover agent delegation without a new protocol?

Source video
causalVerification needed

Without granularity at the transaction layer, operators cannot audit or forensically reconstruct what an agent did.

Evidence

Granularity at the transaction layer is required to audit and know what happened.

Question

What logging granularity is sufficient to reconstruct a rogue-agent incident?

Source video
opinionVerification not requested

Liability for agent actions stays with the deploying employer or user, and intent framing is how that ownership is maintained.

Evidence

The employer or user deploying the agent remains legally and ethically liable.

Source video

Connections

4