AI Engineer · Published 2026-09-01

Your Agent Just Authorized What?! — Jay Mok & Ben Coumes, Paypal

privateReview: unreviewedConfidence: high
agentic commerceauthorizationmandatesoauthfidoagentic-commercestakes-evidence-matrixapproval-tokenap2-mandateverifiable-intentmulti-layer-disclosure
Open on YouTube ↗

Summary

Overview

  • Speaker: Jay Mok & Ben Coumes
  • Channel: AI Engineer
  • Main topic: Agentic Commerce and Agent Authorization
  • Purpose: Provide engineers and architects with a mental model and concrete technical frameworks for safeguarding AI agents against unauthorized transactions and financial loss. Jay Mok and Ben Coumes from PayPal explore the complexities and security challenges of agentic commerce in 2026. They present a mental model based on stakes, ecosystem openness (known vs unknown counterparties), authority (identity and consent), and verifiable proof (dispute handling and auditability), comparing low-stakes scenarios like Claude Code permissions to high-stakes autonomous payment mandates using signable approval tokens and cryptographic standards like FIDO, Verifiable Intents, and AP2.

Topic Map

Introduction to Agentic Commerce Security

  • Explanation: Framing the future of AI agents in 2026 where the threat isn't physical destruction (as in Terminator) but unauthorized wallet access and shopping sprees.
  • Key claims:
    • The nightmare scenario in agentic commerce is agents taking your wallet and going on shopping sprees.
    • Agent authorization requires answering three key questions: Did the human authorize this? Is it allowed right now in this scope? Can we prove it later?
  • Examples:
    • Cryptocurrency and spanks purchased by rogue agents.
  • Terminology:
    • Agentic commerce
    • Agent authorization
    • Identity + consent
    • Runtime, fine-grained
    • Durable, verifiable evidence
  • Why it matters: Establishes foundational questions necessary for establishing trust in autonomous financial transactions.

The Stakes x Evidence Matrix Framework

  • Explanation: A structured matrix evaluating scenarios based on stakes, counterparty relationship, authority mechanism, and evidence/proof requirements.
  • Key claims:
    • Authorization requirements depend entirely on the context of stakes and whether parties know each other.
    • Low-stakes scenarios require minimal proof, while high-stakes unknown counterparty transactions require verifiable cryptographic proofs.
  • Examples:
    • Claude Code permissions (Low stakes)
    • Shared Vault and OAuth scopes (Medium stakes)
    • Signed mandates and approval tokens (High stakes)
  • Terminology:
    • Stakes x evidence matrix
    • Counterparty
    • Open vs closed ecosystem
    • Badge analogy
  • Why it matters: Provides a clear taxonomy for mapping security requirements to different tiers of agentic actions.

PayPal's Approval Token and Autonomous Payment Mandates

  • Explanation: Detailed breakdown of PayPal's approval token primitive, FIDO verifiable intents, and AP2 mandate standardization for autonomous payments.
  • Key claims:
    • When parties are unknown and stakes are high, the industry should converge on FIDO verifiable intents and AP2 mandates.
    • PayPal's approval token carries amount, merchant, and expiry information in an opaque string approved by PayPal.
  • Examples:
    • Travel agent applications using PayPal Vault and OAuth scopes
    • Gemini users using PayPal approval tokens for autonomous merchant checkout
  • Terminology:
    • Approval token
    • FIDO / Verifiable Intent
    • AP2 Mandate
    • Shared Vault
    • OAuth
  • Why it matters: Demonstrates practical enterprise infrastructure designed to enable safe autonomous agentic payments at scale.

Key Points

Context-Dependent Authorization

  • Explanation: How you secure and authorize an agent depends heavily on the level of stakes and whether the counterparty belongs to an open or closed ecosystem.
  • Evidence: The badge-in-building analogy: employees within a trusted building don't need to badge into every room, whereas interactions on the street require verifiable credentials.
  • Practical implication: Engineers must scale authentication rigor relative to financial risk and counterparty familiarity.

Multi-Layered Disclosure Datasets (TDDR)

  • Explanation: Autonomous payments require a multi-layer disclosure architecture involving a trustworthy credential provider, user instructions signed with private keys, and agent authorization tokens.
  • Evidence: PayPal's multi-layered model separating checkout mandates, payment processors, and unsigned/signed tokens.
  • Practical implication: Enables non-related parties to verify transaction integrity without maintaining direct prior relationships.

Applicability Beyond Payments

  • Explanation: The authorization framework for agentic transactions applies universally to any high-stakes, hard-to-reverse agent action.
  • Evidence: Examples include medical orders, e-signatures, and securities trading.
  • Practical implication: Any domain involving irreversible agent actions can leverage signed mandates and verifiable tokens.

Frameworks, Models & Processes

Stakes x Evidence Matrix

  • How it works: Categorizes agent actions into low, medium, and high stakes based on counterparty knowledge, matching each tier with appropriate authority and proof mechanisms.
  • Components:
    • Scenario
    • Stakes
    • Counterparty
    • Authority
    • Evidence/proof
  • When to use: When designing permissioning, authorization, and dispute-resolution layers for AI agent workflows.

Examples & Case Studies

A travel agent app requests payment access to a user's commercial credit card via PayPal Vault and OAuth.

  • Illustrates: Medium-stakes closed ecosystem transaction where parties are known through an intermediary platform.
  • Lesson: Closed ecosystems simplify dispute handling via transaction logs, reducing the need for heavy cryptographic proofs.

Actionable Takeaways

  • Immediate:
    • Evaluate your agent integrations against the stakes x evidence matrix.
    • Adopt time-bound, amount-bounded authorization scopes for agent tools.
  • Strategic:
    • Transition toward verifiable intents (FIDO) and AP2 mandates for autonomous agent transactions.
    • Build multi-layered disclosure structures for high-stakes agent workflows beyond payments.
  • Questions to investigate:
    • How will verifiable credentials scale across multi-agent handoffs?
    • What are the latency costs of cryptographic proof verification in real-time checkout flows?

Claims Worth Verifying

  • AP2 mandate standardization will become the industry standard for autonomous payments by 2026. (industry adoption prediction)
  • PayPal's approval token supports verifiable intent across third-party AI assistants like Gemini. (technical capability)

Notable Quotes

"Your Agent Just Authorized What?!" (at 0:56) "Did the human authorize this? Is this allowed right now, in this scope? Can we prove it later?" (at 2:07)

Compressed Summary

  • Agentic commerce requires robust authorization models based on identity, scope runtime, and verifiable proof.
  • The Stakes x Evidence Matrix maps low, medium, and high-stakes scenarios to appropriate authority models.
  • PayPal's approval tokens and FIDO verifiable intents enable trustless, high-stakes autonomous agent payments.
  • Keywords: agentic commerce, authorization, mandates, oauth, fido
  • Core insight: Securing agentic commerce requires shifting from static permissions to contextual, verifiable, and constraint-bound approval tokens scaled to transaction stakes.

Core insights

6
Mental Modelhigh noveltystrong evidence

Authorization for agent actions should be tiered by a Stakes x Evidence matrix: the rigor of authentication and proof should scale with the financial/operational stakes and with whether the counterparty is known, rather than applying one uniform standard to every agent action.

Why it matters

Engineers often design one authorization mechanism for all agent tool calls. This matrix gives a defensible way to decide when OAuth scopes are sufficient, when shared-vault transaction logs are enough, and when cryptographic signed mandates are required, balancing friction against risk.

Generalization

Any system granting an AI agent consequential or irreversible actions can categorize those actions by stakes and counterparty trust to choose the appropriate permission and evidence layer.

Authorization requirements depend entirely on the context of stakes and whether parties know each other.
Open source video
Low-stakes scenarios require minimal proof, while high-stakes unknown counterparty transactions require verifiable cryptographic proofs.
Open source video
Closed ecosystems simplify dispute handling via transaction logs, reducing the need for heavy cryptographic proofs.
Open source video
Architecturemedium noveltystrong evidence

The three-question authorization model for agentic commerce — did the human authorize this, is it allowed right now and in this scope, and can we prove it later — decomposes agent authorization into consent, runtime constraint checking, and durable verifiable evidence. These map to three separable system responsibilities rather than one permission check.

Why it matters

Most agent permission systems only solve the first question. Building systems that separately produce evidence for later dispute resolution is an architectural step beyond traditional API auth and is necessary for real money movement.

Generalization

Engineering an agent authorization layer should include an evidence/audit store as a first-class component, not just an access-control predicate.

Agent authorization requires answering three key questions: Did the human authorize this? Is this allowed right now, in this scope? Can we prove it later?
Open source video
Architecturehigh noveltymoderate evidence

For high-stakes, open-ecosystem transactions, OAuth scopes and platform transaction logs are insufficient; the industry-grade pattern is to combine a FIDO verifiable intent signed by the user with an AP2 mandate so any counterparty can verify the authorization independently of the platform that issued it.

Why it matters

Agentic commerce will frequently involve agents negotiating with merchants the user has no prior relationship with. Trust cannot be mediated by platform logs, so proof must travel with the transaction.

Generalization

Composed agent workflows that cross organizational boundaries should prefer independently verifiable signed intent over scoped API credentials maintained by the consuming platform.

When parties are unknown and stakes are high, the industry should converge on FIDO verifiable intents and AP2 mandates.
Open source video
Medium-stakes closed ecosystem transaction where parties are known through an intermediary platform.
Open source video
Mechanismhigh noveltystrong evidence

PayPal's approval token is a concrete authorization primitive: an opaque string carrying amount, merchant, and expiry, created by PayPal after user approval. It bounds what an agent can authorize while remaining compact enough to embed in checkout flows.

Why it matters

This is an actionable design for a constrained, time-boxed agent credential. Instead of granting an agent broad payment rails, the agent receives a narrow-purpose artifact that expires and is bound to a specific merchant and amount.

Generalization

Agent tool credentials can be minted as narrow-purpose, bounded, opaque artifacts rather than as reusable bearer tokens with broad scopes.

PayPal's approval token carries amount, merchant, and expiry information in an opaque string approved by PayPal.
Open source video
Architecturehigh noveltymoderate evidence

High-stakes autonomous transactions require a multi-layer disclosure architecture: a trustworthy credential provider, user instructions signed with private keys, and agent authorization tokens. This lets non-related parties verify transaction integrity without maintaining a direct prior relationship.

Why it matters

It separates identity/consent providers from payment processors and agent orchestration, avoiding a monolithic trust holder while still enabling independent verification at each hop.

Generalization

Any multi-party agent workflow involving irreversible actions can use layered credentials: one layer proves identity/consent, another proves the specific instruction, another proves authorization to the executing agent.

Autonomous payments require a multi-layer disclosure architecture involving a trustworthy credential provider, user instructions signed with private keys, and agent authorization tokens.
Open source video
Enables non-related parties to verify transaction integrity without maintaining direct prior relationships.
Open source video
Mechanismhigh noveltymoderate evidence

The authorization framework extends beyond payments to any high-stakes, hard-to-reverse agent action, such as medical orders, e-signatures, and securities trading, where a signed mandate and verifiable token are more appropriate than simple tool-permission prompts.

Why it matters

Teams building agents for many regulated or consequential domains can reuse a common pattern instead of inventing domain-specific consent mechanisms.

Generalization

If an agent's action is expensive or irreversible and the counterparty is not already trusted, architect for signed intent and external verifiability from day one.

Any domain involving irreversible agent actions can leverage signed mandates and verifiable tokens.
Open source video
Examples include medical orders, e-signatures, and securities trading.
Open source video

Deep dives

4

Validating the Stakes x Evidence Matrix in production agentic commerce

Research question

Under what conditions do closed-ecosystem transaction logs fail as dispute evidence, even for medium-stakes actions with known counterparties?

Why

The matrix argues that closed ecosystems can rely on transaction logs rather than cryptographic proofs, but a rogue or negligent agent can produce transactions that are authorized yet disputed. Engineers need concrete thresholds for when log-based evidence breaks and cryptographic proof becomes mandatory.

Authorization requirements depend entirely on the context of stakes and whether parties know each other.
Open source video
Closed ecosystems simplify dispute handling via transaction logs, reducing the need for heavy cryptographic proofs.
Open source video
Source video

Latency and failure cost of FIDO verifiable intents and AP2 mandates in real-time agent checkout

Research question

What are the p50/p95 latency and failure rates of FIDO verify-intent and AP2 mandate proof generation/verification compared to OAuth-vault checkout in a realistic agent purchase flow?

Why

The talk itself asks about latency costs. If cryptographic proof adds too much latency or unpredictable failures, autonomous checkout becomes impractical even if security is sound. A measured answer determines when the high-stakes pattern is production-viable.

When parties are unknown and stakes are high, the industry should converge on FIDO verifiable intents and AP2 mandates.
Open source video
What are the latency costs of cryptographic proof verification in real-time checkout flows?
Open source video
Source video

Delegation and scope propagation in verifiable intent chains

Research question

How can an authorized intent be propagated from a parent agent to child agents while preserving bounded scope and producing a verifiable delegation chain without human re-consent at every hop?

Why

Real agentic workflows will delegate sub-tasks. The current verifiable-intent model demonstrates a single agent receiving a signed intent; without delegation semantics, either every hop requires human re-approval or the evidence chain breaks. This is an open problem blocking multi-agent commerce.

Enables non-related parties to verify transaction integrity without maintaining direct prior relationships.
Open source video
Autonomous payments require a multi-layer disclosure architecture involving a trustworthy credential provider, user instructions signed with private keys, and agent authorization tokens.
Open source video
Source video

Dynamic runtime scope-checking for fixed-parameter approval tokens

Research question

How can a time-bound, amount-bound approval token remain safe when the runtime context changes—price drift, stockouts, or itinerary splits—without forcing a human to re-sign every minor variation?

Why

The approval token fixes amount, merchant, and expiry at signing time, but autonomous agents execute in real, changing conditions. If every deviation invalidates the token, agents cannot complete tasks; if deviations auto-extend, the token's binding nature collapses. We need precise revocation and re-scoping semantics.

PayPal's approval token carries amount, merchant, and expiry information in an opaque string approved by PayPal.
Open source video
Source video

Article ideas

4

Your Agent's Permission Check Is Not Authorization—You Need an Evidence Pipeline

The three-question model shows that consent, runtime scope, and durable proof are separate responsibilities; most agent frameworks solve only the first and then cannot answer 'can we prove it later?' in a dispute. Building an evidence store as a first-class component is the architectural line between playful agents and financially-safe agents.

Angle

Argue that standard permission systems are insufficient for money-moving agents and propose separating the three questions at the system level.

Source video

Known Counterparties Are a Security Falsity: Why Closed Ecosystems Give You False Comfort

Closed ecosystems reduce friction today, but when an agent acts against a user the platform logs cannot protect the user from the platform's own blind spots or from a compromised agent inside the trust boundary. Basing dispute resolution on platform-held logs means the platform is the final judge, which is a weak guarantee for open commerce.

Angle

A cautionary argument that medium-stakes known-party reliance on logs is a transient phase; open verification eventually becomes needed as agent boundaries expand.

Source video

Stop Minting Broad OAuth Scopes for Your Agents: Use Approval Tokens Instead

Long-lived OAuth scopes are the wrong abstraction for autonomous agents because they grant all-or-nothing access without fine-grained, expiring constraints. Approval tokens—opaque, merchant/amount/expiry-bound artifacts—are a concrete alternative that preserves user control while letting agents move fast.

Angle

Present PayPal's approval token as a general pattern for constrained, time-boxed credentials in agent systems.

Source video

Signed Mandates Are Not Just for Payments: Verifiable Intent Is General Agent Middleware

The same signed-intent plus verifiable-token pattern applies to medical orders, e-signatures, and securities trading; domains that currently invent bespoke consent mechanisms should instead reuse a general, cross-domain verifiable-intent layer.

Angle

Generalize beyond money movement to show the architectural primitive is about irreversible actions, not just payments.

Source video

Project ideas

4

MandateScopeGuard

movement-lab

An agent checkout system armed with amount/merchant/time-bound approval tokens rejects out-of-bound redirections (different merchant, higher amount, expired token) 100% of the time in a black-box test suite, while allowing in-bound changes without human re-approval.

Proof of concept

Build a minimal mandate server issuing opaque signed tokens, a mock agent performing checkout attempts with mutations, and an enforcement middleware; run randomized attacks against the token boundary.

Measurement

Rejection rate for out-of-bound attempts; count of valid transactions blocked (false positives); end-to-end latency of token validation.

Source video

CredentialLatencyBench

movement-lab

In a realistic local agent checkout loop, FIDO verifiable-intent generation plus AP2 mandate verification adds less than 150 ms to p95 latency compared to an OAuth-vault baseline on commodity hardware.

Proof of concept

Instrument a test harness that runs the same checkout transaction against three modes: OAuth access token, shared-vault token, and FIDO+AP2 signed mandate; measure timing for 10k iterations.

Measurement

p50/p95/p99 latency, throughput, failure rate, and CPU overhead per mode.

Source video

DelegationChainProof

gatehouse

A child agent acting under a parent's signed verifiable intent can be constrained by a delegation certificate such that every hop is provably in-scope, and any out-of-scope child action fails verification without human re-consent at the intermediate hop.

Proof of concept

Extend a verifiable-intent store with delegation tokens: parent issues a bounded delegation to child, child acts, verifier checks scope set intersection and chain signatures; simulate delegation networks.

Measurement

Verification success/failure rate; ability to localize the first out-of-scope node in a synthetic delegation chain; time to validate chains of varying depth.

Source video

IntentSignReview

beyond-evals

Non-expert users can accurately approve or reject machine-predicted action intents in a signed-intent review UI, achieving at least 95% agreement with a domain-expert ground truth on a 50-intent test set.

Proof of concept

Design a review interface showing a machine-predicted intent (action, counterparty, amount, reason) and a single approve/reject button that triggers a FIDO signature; test with representative tasks.

Measurement

User agreement rate, time-to-approve, and self-reported confidence compared to expert labels.

Source video

Architectural implications

4

Agent systems currently commonly reuse OAuth scopes as the primary authorization mechanism, which works inside a closed platform but does not carry independently verifiable proof.

Before

Agents are given broad platform API scopes; disputes are resolved from platform-held logs and the agent's actions are walled inside the platform.

After

In open high-stakes settings, user-signable approval intents and mandates are emitted as credentials that travel with the request to any counterparty.

Consequence

Agent runtimes need a secure path for the human to sign the specific intent, plus storage and retrieval of signed tokens to present during autonomous checkout.

Source video

Authorization is treated as a single upfront accessibility check rather than a lifecycle of 'did the user authorize, is it allowed now, and can we prove it later.'

Before

A static permission or API key is checked at the start and then re-used for all subsequent agent actions.

After

Each high-stakes action presents a time-bound, amount-bounded authorization artifact that can be audited after the fact.

Consequence

Teams will need tooling to mint, validate, refresh, and log bounded credentials rather than relying on a long-lived token service.

Source video

OAuth-based shared vaults are positioned as a medium-stakes, closed-ecosystem solution, but the same architecture is not safe for unknown counterparties.

Before

An agent using a platform vault assumes the platform's transaction logs provide sufficient dispute evidence.

After

Open ecosystem payments switch to FIDO verifiable intents and AP2 mandates, producing evidence the counterparty can verify rather than trusting platform logs.

Consequence

Integrators must classify each integration as closed/open and medium/high stakes, fundamentally changing the authentication stack used for each.

Source video

The same authorization construct can be reused for any irreversible agent action, not just payment transactions.

Before

Medical, legal, and securities workflows each implement bespoke consent and audit mechanisms.

After

Cross-cutting primitives such as signed intents and approval tokens become reusable middleware for high-consequence agent actions.

Consequence

Agent infrastructure vendors should model verifiable intent as a general authorization primitive, rather than as a payment-only integration.

Source video

Tradeoffs and failure modes

3

Closed-ecosystem simplicity versus open-system cryptographic proof

Benefit

Closed ecosystems simplify dispute handling and reduce overhead by relying on transaction logs maintained by the intermediary.

Cost or risk

Open ecosystems cannot fall back on those logs, so every party must implement and verify cryptographic proof, which introduces protocol and integration complexity.

Closed ecosystems simplify dispute handling via transaction logs, reducing the need for heavy cryptographic proofs.
Open source video
Source video

Strong verifiable proof versus checkout latency

Benefit

FIDO verifiable intents and AP2 mandates produce evidence that is binding and independently verifiable.

Cost or risk

Real-time checkout flows may incur added latency from cryptographic proof creation and verification, which could interfere with the agent's moment-of-purchase interaction.

What are the latency costs of cryptographic proof verification in real-time checkout flows?
Open source video
Source video

Stakes-based calibration versus under-protection

Benefit

Low-stakes scenarios can avoid burdensome proof, allowing fast agent operation in known contexts.

Cost or risk

The tradeoff may fail when a seemingly low-stakes action has unexpected downstream consequences or when a previously known counterparty relationship becomes adversarial. The matrix only protects if the stakes/counterparty classification is correct.

Low-stakes scenarios require minimal proof, while high-stakes unknown counterparty transactions require verifiable cryptographic proofs.
Open source video
Source video

Open questions

4

How will verifiable credentials scale across multi-agent handoffs where Agent A delegates to Agent B?

Why unresolved

The summary demonstrates single-agent user approval but does not describe how an authorized intent propagates through a chain of agents without re-consenting at every hop.

Research direction

Design and test delegation semantics that allow a child agent to act under a parent's verifiable intent while retaining a bounded scope, plus evidence of the delegation chain.

Source video

What are the measured latency costs of cryptographic proof verification in real-time agent checkout flows?

Why unresolved

The talk raises the question but does not publish benchmarks; the practical viability of FIDO/AP2 mandates depends on meeting checkout latency expectations.

Research direction

Prototype FIDO verifiable intents and AP2 mandates in a realistic checkout loop and measure p50/p95 latency against OAuth-only and vault-only baselines.

Source video

How does a signed, time-bounded approval token stay consistent with the 'allowed right now in scope' requirement as runtime context changes?

Why unresolved

An approval token fixes amount, merchant, and expiry at signing time, but an autonomous agent may encounter changed pricing, availability, or splits during execution.

Research direction

Explore dynamic scope-checking mechanisms that can reject an intent outside its signed bounds without requiring a human to re-sign every minor variation.

Source video

How do users express consent for an action the agent itself determines, when they never write the specific intent?

Why unresolved

The model depends on user instructions signed with private keys, but autonomous agents often act on inferred goals rather than explicit per-action user text.

Research direction

Investigate user review surfaces that let a human approve a machine-predicted intent before it is signed, and measure trust/comprehension for non-expert users.

Source video

Key claims

7
opinionVerification needed

Agent authorization requires answering three key questions: Did the human authorize this? Is this allowed right now, in this scope? Can we prove it later?

Evidence

Agent authorization requires answering three key questions: Did the human authorize this? Is this allowed right now, in this scope? Can we prove it later?

Question

Are these three questions sufficient and complete for characterizing real agent transaction authorization requirements?

Source video
opinionVerification needed

When parties are unknown and stakes are high, the industry should converge on FIDO verifiable intents and AP2 mandates.

Evidence

When parties are unknown and stakes are high, the industry should converge on FIDO verifiable intents and AP2 mandates.

Question

Do FIDO verifiable intents and AP2 mandates become the de facto standard for open high-stakes agentic commerce?

Source video
predictionVerification needed

AP2 mandate standardization will become the industry standard for autonomous payments by 2026.

Evidence

AP2 mandate standardization will become the industry standard for autonomous payments by 2026. (industry adoption prediction)

Question

By end of 2026, has the AP2 mandate achieved broad industry adoption for autonomous payments?

Source video
factualVerification needed

PayPal's approval token supports verifiable intent across third-party AI assistants like Gemini.

Evidence

PayPal's approval token supports verifiable intent across third-party AI assistants like Gemini. (technical capability)

Question

Can external auditors verify that Gemini-originated payments use the same PayPal approval token and satisfy verifiable-intent requirements?

Source video
factualVerification needed

PayPal's approval token carries amount, merchant, and expiry information in an opaque string approved by PayPal.

Evidence

PayPal's approval token carries amount, merchant, and expiry information in an opaque string approved by PayPal.

Question

Does the production PayPal approval token encoding enforce amount/merchant/expiry at redemption time?

Source video
opinionVerification needed

Autonomous payments require a multi-layer disclosure architecture involving a trustworthy credential provider, user instructions signed with private keys, and agent authorization tokens.

Evidence

Autonomous payments require a multi-layer disclosure architecture involving a trustworthy credential provider, user instructions signed with private keys, and agent authorization tokens.

Question

Are all layers strictly necessary, or can some designs safely omit one layer while preserving the same security properties?

Source video
opinionVerification needed

The authorization framework applies universally to any high-stakes, hard-to-reverse agent action, including medical orders, e-signatures, and securities trading.

Evidence

Any domain involving irreversible agent actions can leverage signed mandates and verifiable tokens.

Question

Does the same signed-intent plus verifiable-token pattern hold up in non-payment regulated domains?

Source video

Connections

4

FIDO Verifiable IntentAP2 Mandate

A user-signed FIDO verifiable intent expresses consent for an autonomous operation, and an AP2 mandate standardizes how that intents-based authorization is represented and presented by the agent.

Source video

OAuth scopesFIDO verifiable intents

OAuth scopes and vault architecture provide sufficient authorization in medium-stakes known-counterparty ecosystems, whereas high-stakes unknown-counterparty ecosystems require the stronger, independently verifiable FIDO intent model.

Source video