PayPal just laid out how it plans to keep agents from raiding your wallet, presenting a clear framework for agent authorization at AI Engineer.
Product manager Jay Mock and staff engineer Ben Coomes said the nightmare in 2026 isn't agents launching nukes. It's agents taking your wallet on a shopping spree for crypto.
The pair offered a mental model built on three questions. Did the human authorize this? Is it allowed right now in this scope? And can we prove it later?
In payments, that translates to a passkey-style consent, a time-bound token with amount and merchant limits, and a dispute-grade audit trail.
Why it matters for AI and startups
PayPal sorts risk by stakes and counterparty familiarity, then matches it to proof. Low-stakes coding with Claude Code lives in a closed network with allow, deny, or ask permissions, and logs plus revert are enough.
Medium-stakes money movement needs more control without heavy cryptography. The example: Nevermind using the PayPal and Braintree vault for stored credentials and exposing them to buyer and seller agents via OAuth scopes, as with a TripAdvisor-style data seller monetizing content to travel agents.
That pattern borrows trust from a shared platform, a useful bridge for startups selling data or services to agents today without building open-network signatures.
What still goes unanswered
For high-stakes open-network payments, where buyer and seller don't know each other, PayPal points to FIDO verifiable intents and Google's AP2 mandate. It's a selective-disclosure JWT with up to three layers: credential provider, user instructions signed by the user's private key, and agent signature.
The missing piece is portability. PayPal's new Approval Token implements the same idea for agentic checkout, a JSON payload with amount, expiry, and merchant returned after a redirect to PayPal, but Coomes noted it is currently an opaque string only PayPal can verify and is about to ship with early partners.
Until that becomes verifiable by any merchant or processor, founders can't treat it as an open standard, and reliability for hard-to-reverse actions like medical orders or trading remains unproven.
