What is intent-based authorization for AI agents?

It is a runtime model that authorizes each agent action against a stated mission, environment context and resource budget instead of a pre-registered OAuth scope. The mission travels with the decision so it can be audited later.

Why are OAuth scopes not enough for agents?

OAuth scopes were designed for pre-registered clients and browser redirects, and they describe categories of access rather than a specific goal. A broad scope such as API access tells a policy engine nothing about which records an agent should touch.

AAuth is an agent authorization proposal created by Dick Hardt, co-creator of OAuth, that adds missions, time-limited tokens and resource budgets to agent access. Its budget mechanism is designed to hand control back to a supervising agent rather than silently cut the agent off.

What happened in the Resy incident?

According to the panel, an agent acting for a user made about 200 API calls in 90 minutes while trying to book a reservation, and the user's Resy account was banned. The panel treated it as evidence that agents need bounded budgets and a supervisor.

Does intent-based auth make agents safe for regulated industries?

No. It gives engineers a runtime decision point and an audit trail, but compliance, tenant isolation and regulatory suitability remain controls the organization must supply. The panel described the tooling as an enabler, not a certification.

Intent-based auth for AI agents

Intent-based auth for AI agents is a runtime model that authorizes each action using a stated mission, a budget and a separate supervising agent, rather than a broad OAuth scope. OAuth co-creator Dick Hardt and JPMorgan Chase's Michael Davis argued at AI Engineer NYC in October 2026 that scopes were never designed for goal-seeking software.

FAQ

What is intent-based authorization for AI agents? It is a runtime model that authorizes each agent action against a stated mission, environment context and resource budget instead of a pre-registered OAuth scope. The mission travels with the decision so it can be audited later.

Why are OAuth scopes not enough for agents? OAuth scopes were designed for pre-registered clients and browser redirects, and they describe categories of access rather than a specific goal. A broad scope such as API access tells a policy engine nothing about which records an agent should touch.

What is AAuth? AAuth is an agent authorization proposal created by Dick Hardt, co-creator of OAuth, that adds missions, time-limited tokens and resource budgets to agent access. Its budget mechanism is designed to hand control back to a supervising agent rather than silently cut the agent off.

What happened in the Resy incident? According to the panel, an agent acting for a user made about 200 API calls in 90 minutes while trying to book a reservation, and the user's Resy account was banned. The panel treated it as evidence that agents need bounded budgets and a supervisor.

Does intent-based auth make agents safe for regulated industries? No. It gives engineers a runtime decision point and an audit trail, but compliance, tenant isolation and regulatory suitability remain controls the organization must supply. The panel described the tooling as an enabler, not a certification.

What is Gustavo Dev Doido's Crazystack Typescript? Crazystack Typescript is a TypeScript stack associated with Brazilian developer educator Gustavo Dev Doido, whose Bootcamp do Dev Doido teaches the stack. The AI Engineer NYC session did not discuss this stack.

Can intent-based auth stop an agent from making a double payment? Intent and mission context make a duplicate payment detectable, because the supervisor can see that the same payment occurred seconds earlier. The enforcement still depends on the policy layer that evaluates that context.

Where should the audit log live? The audit log must sit outside the agent's reach, alongside the egress proxy that enforces policy. An agent that can alter its own records cannot support a liability finding when an action causes damage.

What does Skala Blog publish on this topic? Skala Blog publishes articles generated from engineering talks and transcripts, including conference sessions on agent security and runtime authorization. Review any generated draft before publishing it.

Turn the talk into an article

The panel kept returning to one idea: an agent cannot be accountable, so the mission, the budget and the record of what happened have to live outside it. If your own YouTube videos carry that kind of reasoning, the same structure is what makes a written version worth reading. With Skalablog you paste a video URL, the transcript is generated, and a structured article draft comes back for you to edit before it goes anywhere. Start at Skala Blog.

Source video