An AI Agent Got Its User Banned From Resy - Keycard, JPMorgan Chase & AAuth

As AI agents gain autonomy, traditional coarse-grained authorization models like OAuth are insufficient; intent-based authorization - capturing mission context...

An AI Agent Got Its User Banned From Resy: Intent-Based Authorization as the Foundation for Safe Agentic Autonomy

Abstract

As artificial intelligence agents acquire greater operational autonomy, existing authorization models - most notably OAuth - are structurally unable to express the dynamic, context-dependent permission needs of reasoning systems. This synthesis analyzes intent-based authorization, a paradigm in which permissions are computed at runtime from a persistent mission supplied by an accountable human or organization, intersected with deterministic organizational policy. The methodology draws on documented production incidents, including an agent-induced account ban on Resy and a proxy vulnerability at Hugging Face, to ground architectural recommendations such as brain/hands separation, egress-proxy enforcement, and resource-limited token budgets. Findings indicate that coarse-grained, pre-registered scopes - exemplified by Salesforce's single API scope - cannot support task-level reasoning, and that dynamic authorization is migrating from a security-team function into core engineering practice. Practical implications include the need for tamper-resistant audit logging, federated trust protocols, and liability frameworks tied to human accountability rather than agent autonomy.

1. Introduction

The deployment of autonomous software agents into production environments has exposed a mismatch between how permissions are modeled and how agents actually behave. Traditional authorization assumes deterministic software with a fixed, enumerable set of operations known at registration time. Agents built on Large Language Models (LLMs) violate this assumption: their action sequences are generated at inference time, conditioned on natural-language instructions whose scope cannot be anticipated by system designers.

Two terms anchor this analysis. Runtime authorization denotes "the practice of authorizing an agent per tool call, rather than having the agent hold broad standing access that it will eventually misuse." Intent denotes the why behind an action - the strategic justification that distinguishes a contextually permissible operation from a strategically incorrect one. A duplicate payment may satisfy every syntactic permission check while being plainly wrong relative to the originating purpose, illustrating that syntactic validity and strategic correctness are separable properties.

The central thesis examined here is that safe agent autonomy requires authorization systems capable of capturing mission context, intersecting multiple layers of intent, and rendering decisions at runtime rather than at registration time. As stated in the source material: "Until we actually solve that underlying problem, realizing true autonomy... we have to solve intent first." This paper proceeds by establishing why incumbent models fail (§2), analyzing the intent and mission constructs alongside the intersection policy model (§3), examining enforcement architectures and production incidents (§4), and discussing accountability, ecosystem governance, and risk calibration (§5).

2. Background and Related Work

OAuth was designed for website-to-website delegation. Its operational assumptions - pre-registered clients, browser-mediated redirects, and statically declared scopes - encode a world in which the delegating party knows in advance what the delegated party will do. As the source material states: "OAuth was not designed for this world... the agentic world is completely different. We don't know ahead of time what the agent needs to do."

This granularity problem is compounded by enterprise identity fragmentation. Security-first organizations, particularly in regulated sectors such as financial services, operate heterogeneous identity systems that agents must navigate without a unifying abstraction. Salesforce, for an extended period, exposed a single OAuth scope - API - granting undifferentiated access to its programmatic surface. Scopes mapped from such legacy systems are far too coarse for agentic use cases, where the natural unit of authorization is the individual tool invocation rather than the application integration.

3. Core Analysis

3.1 Intent, Mission, and the Accountability Chain

The analysis introduces mission as the big-picture goal given to an agent by an accountable person or organization, persisting across the agent's work. Critically, "the agent can't be responsible... the mission is something that the person is giving the agent to do." This construct ties every downstream authorization decision back to a human or organizational principal, preserving accountability even as agents act with increasing independence. Two chat sessions with identical available tools but different stated intents - shopping versus debugging - warrant substantially different permission profiles and human-in-loop thresholds, demonstrating that tool access alone is an insufficient basis for authorization.

A negotiation phase is proposed as a mechanism for resolving ambiguity: rather than acting on vague or risky requests (e.g., forwarding a CEO's email), agents should clarify mission parameters with users before execution. This shifts part of the authorization burden from static policy enforcement to interactive clarification at the point of ambiguity.

3.2 The Intersection Model of Policy

Deterministic policy is reserved for defining "what must never happen" and specifying when human involvement is mandatory. Between broad organizational policy and specific task-level authorization needs lies a gap that the intersection model addresses by distinguishing two levels of intent: interactional intent (user-to-agent) and organizational intent (why the agent or tool was adopted in the first place). Authorization decisions are computed as the intersection of these intents, producing a "bounding box" of allowed actions for any given task. This approach is explicitly designed to avoid consent fatigue, minimizing human-in-loop interruptions except when genuinely necessary.

3.3 Agentic Commerce and the Trust Infrastructure Gap

In commerce contexts, intent serves two accountability functions: enabling users to ensure agents transact within budget and rules, and enabling merchants to capture purchase intent to assess trust. This parallels the extension of Know Your Customer (KYC) principles into "Know Your Agent" frameworks within financial services. However, the web currently lacks infrastructure for unregistered agent clients to authenticate and be trusted, unlike the CAPTCHA-based gating available for human users. The blocking of Vercel in Spain due to shared IP addresses hosting pirated content illustrates how infrastructure-level trust problems - already present for conventional web services - apply with greater severity at agentic scale. Early efforts such as Personal Agent Protocols (Poppy, Sierra, Decagon) address parts of this problem but do not yet solve interoperable trust and supervision, motivating calls for federated protocols analogous to OIDC or TLS rather than closed, vendor-controlled systems.

4. Technical Insights

Several architectural patterns emerge as practical responses to the intent-based authorization problem:

• Brains vs. hands separation: The agent's reasoning component (LLM) is sandboxed apart from its tool-execution component ("hands"), with an egress proxy enforcing the authorization boundary between the two. This limits the blast radius of any single reasoning error.
• Independent supervising agents: A supervising agent that enforces policy should not be controlled by the same vendor building the worker agent, reducing conflicts of interest in policy enforcement.
• AI off budgets: Time-limited and resource-limited tokens provide continual feedback to agents rather than hard rate-limit cutoffs, allowing graceful degradation instead of abrupt failure.
• Dynamic tool availability: Tools are added or removed based on current task context (e.g., disabling web search during an email-writing task), reducing "toxic combinations" of capabilities that could be jointly misused.
• Tamper-resistant, agent-independent audit logs: These are critical for forensics, as illustrated by the Hugging Face incident, where an unpatched Squid proxy vulnerability combined with insufficient observability of agent actions to produce a security gap.

The Resy incident - in which an agent made 200 API calls per hour attempting to complete a reservation, resulting in an account ban - demonstrates that resource budgeting is necessary even when agent intent is benign; good intent does not substitute for rate-aware resource constraints.

5. Discussion

These findings collectively suggest that authorization for agentic systems cannot be solved purely at the security layer; it requires architectural decisions embedded in engineering practice from the outset. The shift "from authentication to dynamic authorization" reflects a broader trend in which permission modeling becomes a design-time concern for application engineers rather than an afterthought handled by identity teams. This has implications for reference architectures such as the Agent Baseline model, which distinguishes human-driven, workflow-driven, and agentic-driven maturity levels.

A persistent gap remains in interoperable trust infrastructure: without federated protocols comparable to OIDC or TLS, agentic commerce and cross-organizational agent interaction risk consolidating around closed, vendor-specific systems, undermining the openness that characterized earlier web infrastructure. Runtime authorization decisions should additionally incorporate environmental context - time of day, device or browser used, system vulnerability status, sandbox location - drawing an explicit analogy to robotics, where sensor data and external conditions inform real-time decision-making beyond stated intent alone.

On the question of catastrophic risk, panelists expressed skepticism toward existential AI risk scenarios, characterizing fully autonomous agents untied to any organization as still "science fiction." Primary risks identified were comparatively mundane: insider threats and deliberate weaponization of agent tooling by malicious actors, rather than emergent agent misalignment. The retained ability to "unplug" agents - through physical and infrastructure control - combined with existing liability frameworks and iterative engineering correction, was viewed as a sufficient safeguard without requiring novel AI-specific regulation.

6. Conclusion

This synthesis demonstrates that coarse-grained authorization models inherited from web-era delegation standards cannot support the dynamic, context-sensitive permission needs of reasoning agents. Intent-based authorization - anchored in persistent mission context, computed through the intersection of interactional and organizational intent, and enforced through architectures such as brain/hands separation and resource-limited budgets - offers a structurally sound alternative. The practical takeaway for engineering teams is that dynamic authorization must be designed into agent systems from inception, supported by tamper-resistant audit logging and clear accountability chains tying every agent action back to a responsible human or organization. Future work should focus on establishing federated, interoperable trust protocols for agentic commerce and cross-organizational agent interaction, extending the lessons of existing identity standards into this new operational context.

Sources

• An AI Agent Got Its User Banned From Resy - Keycard, JPMorgan Chase & AAuth - Original Creator (YouTube)
• Analysis and summary by Sean Weldon using AI-assisted research tools

About the Author

Sean Weldon is an AI engineer and systems architect specializing in autonomous systems, agentic workflows, and applied machine learning. He builds production AI systems that automate complex business operations.

LinkedIn | Website | GitHub