Resy ban shows why agents need per-call authorization

Name: Resy ban shows why agents need per-call authorization
Uploaded: 2026-10-18T12:10:12.479Z
Description: An Instinct agent's 200 calls per hour to Resy.com got its user banned, prompting Keycard, JPMorgan Chase and AOTH leaders to push per-call runtime authorization.

An Instinct agent's 200 calls per hour to Resy.com got its user banned, prompting Keycard, JPMorgan Chase and AOTH leaders to push per-call runtime authorization.

Daniel Singer

Editor, StartupHub.ai

Oct 18 at 12:10 PM1 min read

Panel discussion on intent-based runtime authorization for AI agents — AI Engineer

AI Engineer convened Keycard, JPMorgan Chase and AOTH founders to detail intent-based runtime authorization after 200 Resy.com calls per hour got a user banned.

Resy ban shows why agents need per-call authorization - AI Engineer — Resy ban shows why agents need per-call authorization, AI Engineer

Dick Hart said OAuth was never built for agents that lack browsers, pre-registration or fine-grained scopes.

Ally How of Keycard said "Runtime off is the practice of authorizing an agent per tool call rather than having the agent hold broadstanding access that it will eventually misuse" during the panel.

Salesforce offers a single API scope and Notion's MCP server exposes broad fetch tools, both cited as coarse-grained risks compared with Keycard's per-call checks.

Keycard evaluates policy on every token exchange via OAuth 2.0 Token Exchange RFC 8693 and scopes access to the task, per its docs.

The panel described a brains versus hands split where credentials live in an egress proxy, not in the model, and separate tamper-resistant logs answer who did what.

Keycard's reference architecture for a secure software factory is now published at agentbaseline.org for teams onboarding agents like developers.

© 2026 StartupHub.ai. All rights reserved. You may not republish this article in full without a license. Search engines and AI research tools may crawl and summarize for reference. Bulk reproduction or model training requires a license. See our terms.

#Keycard #JPMorgan Chase #AOTH #OAuth #Resy #Instinct #Salesforce #Notion

Watch

The videos behind the news, one flip at a time

The feed mixes the videos from our articles with startup demos and you flip through them like TV channels for free with no signup.

Open the video feed

Written by

Daniel Singer

Editor, StartupHub.ai

Daniel Singer is the editor of StartupHub.ai, a technology expert and thought leader on AI and its applications across sectors, from fintech and healthcare to developer tooling and consumer software. He writes and tests the tools covered here thoroughly and regularly, and built StartupHub.ai to give founders, operators and buyers a clearer read on what they are actually being sold.