Jay Mok and Ben Coumes organize agent authorization around three questions: whether a human approved an actionHuman judgment in AI is the accountable interpretation and decision-making people contribute when setting goals, evaluating evidence, and managing consequences., whether it is allowed within the current scopeAn agent permission boundary defines and enforces which resources and actions an automated agent is allowed to use. and whether that approval can be proved afterward. They argue that the answers depend on the consequences of a mistake and whether the parties operate inside a shared trust boundary.
Jay Mok illustrates the framework with coding tools and payments inside a known ecosystem. For reversible coding work, connector consent, tool permissions and system logs may provide sufficient controls in the scenario he describes. In the payment example, a shared credential vault and OAuth scopes support delegated authority while transaction logs preserve evidence inside the trusted system.
Ben Coumes argues that autonomous transactions between unfamiliar parties need portable, verifiable proof of human instructions. He proposes convergence on FIDO verifiable intents and AP2 mandates, describing a layered structure in which a credential provider, the user and, when applicable, the agent sign different parts. Selective disclosure would let a merchant or payment processor verify the information relevant to its role.
Ben Coumes describes a PayPal approval-token example that separates initial user authorization from a later agent purchaseAgentic commerce uses AI agents to assist with stages of buying and selling, such as product discovery, comparison and checkout.. The token carries constraints such as amount, expiry and merchant, but he explicitly distinguishes this from interoperable verifiable intent: the opaque token can currently be approved only by PayPal. The broader design goal is to bind later actions to the permission originally granted.
Jay Mok and Ben Coumes conclude that the same reasoning could apply beyond payments to other difficult-to-reverse actions. Their framework scales the evidence requirement with risk and unfamiliar counterparties, rather than treating possession of an agent identityAn AI agent identity is a persistent, verifiable identifier used to attribute messages, actions, permissions, and history to an agent. or access credential as sufficient proof of authorization.
Watch on YouTube
