An AI Agent Got Its User Banned From Resy — Keycard, JPMorgan Chase & AAuth

Highlights

• Traditional OAuth scopes fail for autonomous systems because coarse-grained permissions grant broad standing access that non-deterministic agents misuse.

• An Instinct agent triggered a user ban on Resy by executing 200 API calls in a single hour to secure a restaurant reservation.

• AAuth introduces consumption budgets alongside expiring tokens to give agents real-time feedback on remaining resource limits.

• Sandboxing the model brain away from execution tools forces egress proxies to enforce network authorization boundaries without giving agents direct API keys.

• Dynamic runtime authorization trims unused tools dynamically during active workflows, preventing toxic combinations and reducing overall token spend.

• External, tamper-resistant audit logs establish legal liability by mapping agent actions back to the human or enterprise principal.

Timeline

1. 00:00 - 05:11

   The Failure of Coarse Permissions and OAuth in Agent Systems

   Legacy authorization architectures rely on humans making deterministic decisions in advance. Platforms like Salesforce historically offered coarse permissions such as a single API scope, which gives autonomous systems far too much latitude. Safe enterprise adoption mirrors developer onboarding, starting agents with restricted capabilities and escalating privileges as environmental safety checks pass.

   • Runtime authorization verifies each tool call individually instead of granting broad, permanent credentials.
   • OAuth was built for pre-registered web redirects and cannot adapt to dynamic, non-deterministic agent workflows.
   • Enterprises restrict early agent access by verifying execution context like sandboxes instead of trusting self-attestation.
2. 05:12 - 16:36

   The Architecture of Intent, Missions, and Policy Intersection

   Checks incorporate transaction limits, payees, and memo fields to express runtime intent, offering a blueprint for governing software agents. Unscoped agent access creates severe outage risks, such as accidentally wiping production databases instead of staging environments. An independent supervising agent enforces deterministic boundary policies, rejecting malicious prompts and keeping human operators out of the loop until high-risk thresholds trigger.

   • Financial systems authorize individual transactions at runtime rather than relying strictly on identity authentication.
   • The AAuth framework tracks a persistent mission identifier across distributed operations to contextualize each tool call.
   • Operational safety depends on calculating the intersection between broad corporate guardrails and the specific mission prompt.
3. 16:37 - 24:51

   Agentic Commerce and Cross-System Identity Standards

   Web infrastructure struggles with unauthenticated traffic, as shown when Spain blocked entire Vercel IP pools to stop a single illicit Premier League streamer. Open, federated protocols prevent dominant platforms from centralizing agent transactions behind proprietary walled gardens. Tracking intent creates psychological and operational links to human owners, ensuring enterprises retain legal accountability when automated purchases fail.

   • Unregistered agents navigating public websites break traditional fraud defenses like CAPTCHAs.
   • Personal Agent Protocol (PAPI) provides baseline identity but lacks complete oversight for complex transactions.
   • Motive-aware forensics allow investigators to trace the root cause of an agent failure directly to human intent or software error.
4. 24:52 - 31:27

   Mitigating Abuse with Resource Budgets and Sandboxed Hands

   An automated booking agent made 200 calls an hour on Resy because it lacked an internal governor or budget signal, prompting a permanent platform ban. A safe architecture sequesters tools inside sandboxes and routes traffic through external egress proxies where policies apply outside agent control. Disabling external search during email generation stops exfiltration attempts while focusing the model solely on the immediate step.

   • AAuth budgets replace hard rate limits with live consumption feedback so agents regulate scarce resource usage.
   • Isolating LLM brains from tool-executing hands prevents agents from discovering and abusing raw API keys.
   • Dynamically removing unneeded tools eliminates toxic capability combinations and lowers total token spend.
5. 31:28 - 43:18

   Production Deployment, Multi-Sensor Governance, and Liability

   Robotics systems check external environmental sensors before executing physical actions, a model runtime authorization adopts via OpenTelemetry spans and contextual infrastructure data. The Hugging Face Squid proxy incident demonstrated the danger of deploying agents without external monitoring points. Existing liability laws already assign fault to the individual or business operating the software, anchoring catastrophic risk mitigation in standard legal frameworks.

   • Moving from authentication to authorization enables teams to build autonomous software factories.
   • Probabilistic authorization decisions ingest contextual telemetry such as device patch status and vulnerability scans.
   • External audit logs maintain legal liability trails that prevent rogue agents from covering their tracks.