Jay Mok and Ben Coumes organize agent authorization around three questions: whether a human approved an action, whether it is allowed within the current scope and whether that approval can be proved afterward. They argue that the answers depend on the consequences of a mistake and whether the parties operate inside a shared trust boundary.
Jay Mok illustrates the framework with coding tools and payments inside a known ecosystem. For reversible coding work, connector consent, tool permissions and system logs may provide sufficient controls in the scenario he describes. In the payment example, a shared credential vault and OAuth scopes support delegated authority while transaction logs preserve evidence inside the trusted system.
Ben Coumes argues that autonomous transactions between unfamiliar parties need portable, verifiable proof of human instructions. He proposes convergence on FIDO verifiable intents and AP2 mandates, describing a layered structure in which a credential provider, the user and, when applicable, the agent sign different parts. Selective disclosure would let a merchant or payment processor verify the information relevant to its role.
Ben Coumes describes a PayPal approval-token example that separates initial user authorization from a later agent purchase. The token carries constraints such as amount, expiry and merchant, but he explicitly distinguishes this from interoperable verifiable intent: the opaque token can currently be approved only by PayPal. The broader design goal is to bind later actions to the permission originally granted.
Jay Mok and Ben Coumes conclude that the same reasoning could apply beyond payments to other difficult-to-reverse actions. Their framework scales the evidence requirement with risk and unfamiliar counterparties, rather than treating possession of an agent identity or access credential as sufficient proof of authorization.
Watch on YouTube
