A Mental Model for Agentic Payment Authorization

The Breakthrough

PayPal developed an approval token that inverts the traditional synchronous payment flow, allowing users to authorize an agent to transact before the agent has identified a specific item or merchant.

What Actually Worked

• Low-Stakes Coding Agents: Rely on standard system logs and reversible actions, where human consent is established once via tool-level permissions (allow, ask, or deny).
• Medium-Stakes Shared Vaults: Utilize OAuth scopes and shared infrastructure (like Braintree or PayPal enterprise) to enforce payment mandates between known counterparties, relying on transaction logs for dispute resolution.
• High-Stakes Autonomous Transactions: Propose using multi-layered selective disclosure JSON Web Tokens (JWTs) to allow merchants and processors to verify payment mandates without requiring a pre-existing relationship between parties.
• Approval Token Implementation: The system returns a JSON payload containing the transaction amount, expiry, and permitted merchant, which the agent uses to execute the payment autonomously.

Context

As agents gain the ability to perform high-stakes, irreversible actions, developers must solve three core problems: verifying human authorization, ensuring the action is permitted within the current scope, and providing cryptographic proof for later dispute resolution. The authors categorize these needs into a ladder based on stakes and counterparty trust, arguing that as the environment moves from closed ecosystems to open, unknown counterparties, the reliance on system logs must shift toward verifiable cryptographic intents.

Notable Quotes

• "The approval token demonstrated here inverts that: the user approves before the agent has found an item or picked a merchant."
• "If there's going to be autonomous payments at scale, we think that multi-layer selective disclosure JWT is going to be the best way to accomplish it."

Content References