AI Engineer's An AI Agent Got Its User Banned From Resy — Keycard, JPMorgan Chase & AAuth: skim's analysis identifies 12 key moments, with 2 potential conflicts of interest flagged. Security leaders from Keycard, JPMorgan Chase, and AAuth explain why coarse-grained OAuth scopes prevent enterprises from granting AI agents real autonomy.
Category: Tech. Format: Panel Discussion. YouTube video analyzed by skim.
skim AI Analysis
Credibility assessment: High Practitioner Credibility. The panel features OAuth co-creator Dick Hardt, JPMorgan Chase Global Chief Security Architect Michael Davis, and Keycard CEO Ian Livingstone discussing direct architectural challenges from first-hand engineering and enterprise security experience.
Bias assessment: Vendor and Protocol Advocacy. Moderated by Keycard staff with Keycard's CEO and AAuth's founder on stage, the discussion naturally favors intent-based runtime authorization and the specific open protocols and architectures the speakers are actively building.
Originality: 82% — Novel Architectural Framing. Rather than repeating generic AI safety talking points, the panelists introduce concrete mental models like check memo fields for intent, resource budgets instead of rate limits, and separating an agent's brain from its hands.
Depth: 80% — Strong Systems Analysis. The discussion systematically breaks down why legacy OAuth scopes fail for non-deterministic agents and details how egress proxies, supervisory agents, and environmental telemetry solve runtime authorization.
Key Points (12)
1. Coarse Legacy Security Blocks Agent Autonomy
Timestamp: 00:00:12 to 00:03:19
Allie Howe and Ian Livingstone explain that enterprises hesitate to grant AI agents autonomy because legacy systems rely on coarse-grained permissions like single API scopes. Ian Livingstone notes that existing security models assume deterministic software and human decision-makers rather than goal-seeking models.
Significance (High): Enterprises in regulated industries cannot safely deploy autonomous agents on top of fragmented identity islands without finer access controls.
Sources in support: Allie Howe (Member of Technical Staff, Keycard), Ian Livingstone (CEO & Co-founder, Keycard)
2. Why OAuth Fails for AI Agents, According to Hardt
Timestamp: 00:03:19 to 00:05:31
OAuth co-creator Dick Hardt explains that OAuth was designed for pre-registered websites using browser redirects and coarse scopes, which fails when agent tasks are unknown ahead of time. Michael Davis adds that successful enterprises onboard agents gradually like junior developers and verify their runtime environment.
Significance (High): Relying on static OAuth scopes leaves systems exposed because different instances of an agent require dynamic, context-dependent permissions.
Sources in support: Dick Hardt (Co-creator of OAuth & Creator of AAuth), Michael Davis (Global Chief Security Architect, JPMorgan Chase)
3. Michael Davis Links Banking Checks to Agent Intent
Timestamp: 00:05:35 to 00:08:52
Michael Davis compares runtime agent authorization to how banks shifted from authenticating humans to authorizing individual transactions, using a check's memo field and limits as an analogy for intent. Dick Hardt and Ian Livingstone add that big-picture mission context prevents duplicate actions and catastrophic production deletions.
Significance (High): Evaluating individual transactions against broader session intent allows organizations to prevent high-risk mistakes like deleting a production database.
Sources in support: Michael Davis (Global Chief Security Architect, JPMorgan Chase), Dick Hardt (Co-creator of OAuth & Creator of AAuth), Ian Livingstone (CEO & Co-founder, Keycard)
4. AAuth Missions and Supervisory Agents
Timestamp: 00:08:52 to 00:12:02
Dick Hardt outlines how AAuth assigns a tracked mission identifier negotiated between the responsible human or organization and the worker agent. To enforce boundaries like blocking unauthorized access to a CEO's email, he proposes a separate supervising agent that evaluates what the worker agent is permitted to do.
Significance (High): Separating worker agents from supervisory agents creates an auditable trail tied to human accountability while catching ambiguous policy violations.
Sources in support: Dick Hardt (Co-creator of OAuth & Creator of AAuth), Allie Howe (Member of Technical Staff, Keycard)
5. Intersecting Policies to Avoid Consent Fatigue
Timestamp: 00:12:04 to 00:16:36
Ian Livingstone warns that prompting users too frequently causes consent fatigue, arguing for intersecting broad organizational policies with specific task intents into a bounding box. Michael Davis agrees that combining decoupled intents across an organization enables dynamic runtime decisions and long-lived diagnostics.
Significance (Medium): Calculating the intersection of business intent and task intent minimizes human interruptions while keeping agents within safe operational boundaries.
Sources in support: Ian Livingstone (CEO & Co-founder, Keycard), Michael Davis (Global Chief Security Architect, JPMorgan Chase), Allie Howe (Member of Technical Staff, Keycard)
6. Know Your Agent and Unregistered Web Traffic
Timestamp: 00:16:36 to 00:19:54
Michael Davis proposes extending financial Know Your Customer rules into a Know Your Agent framework for agentic commerce. Ian Livingstone illustrates the danger of unverified traffic by noting how Spain blocked all of Vercel over a single IP-sharing host, warning that unregistered agents face the same trust crisis now that they can break CAPTCHAs.
Significance (Medium): Without verifiable agent identity rails, websites cannot distinguish legitimate personal shopping agents from abusive bot traffic.
Sources in support: Michael Davis (Global Chief Security Architect, JPMorgan Chase), Ian Livingstone (CEO & Co-founder, Keycard), Allie Howe (Member of Technical Staff, Keycard)
7. Open Federated Protocols and Human Forensics
Timestamp: 00:19:57 to 00:24:51
Dick Hardt and Ian Livingstone advocate for open, federated protocols like AAuth so users can run independent supervisory agents rather than surrendering guardrails to proprietary vendor walled gardens. Michael Davis adds that linking explicit human intent to agent outcomes creates psychological ownership and accelerates post-incident forensics.
Significance (Medium): Open standards prevent vendor lock-in for safety controls while immutable intent records allow security teams to separate human error from agent bugs.
Sources in support: Dick Hardt (Co-creator of OAuth & Creator of AAuth), Ian Livingstone (CEO & Co-founder, Keycard), Michael Davis (Global Chief Security Architect, JPMorgan Chase)
8. How AAuth Budgets Prevent the Resy Ban
Timestamp: 00:24:52 to 00:26:59
Allie Howe recounts how an eager Instinct agent made 200 API calls an hour trying to book a restaurant and got its user banned from Resy. Dick Hardt explains that AAuth solves this by giving agents time-limited tokens paired with continuous resource budget feedback so the agent knows to conserve scarce calls instead of hitting blind rate limits.
Significance (High): Giving agents explicit visibility into remaining resource budgets stops goal-seeking loops from unintentionally launching denial-of-service style abuse.
Sources in support: Allie Howe (Member of Technical Staff, Keycard), Dick Hardt (Co-creator of OAuth & Creator of AAuth)
9. Separating the Agent's Brain from Its Hands
Timestamp: 00:27:01 to 00:31:26
Ian Livingstone explains the brains-versus-hands architecture, where the LLM brain and its sandboxed tool hands never hold raw API keys, and an external egress proxy enforces authorization boundaries. Michael Davis adds that decoupling allows teams to dynamically disable dangerous tool combinations, such as cutting off web egress while reading emails.
Significance (High): Enforcing authorization at an external egress proxy and dynamically removing tools prevents compromised or goal-seeking models from exfiltrating data.
Sources in support: Allie Howe (Member of Technical Staff, Keycard), Ian Livingstone (CEO & Co-founder, Keycard), Michael Davis (Global Chief Security Architect, JPMorgan Chase)
10. Production Agents and Secure Software Factories
Timestamp: 00:31:29 to 00:35:03
Michael Davis reports that constraining what an agent can do via dynamic authorization directly lowers agent error rates and unites security and application engineers around shared threat models. Ian Livingstone connects runtime authorization to Keycard's reference architecture on agentbaseline.org for autonomous software factories that deploy and auto-patch code.
Significance (Medium): Scoping agent capabilities tightly improves reliability in production and unlocks autonomous software deployment pipelines.
Sources in support: Michael Davis (Global Chief Security Architect, JPMorgan Chase), Ian Livingstone (CEO & Co-founder, Keycard)
11. Robotics Sensors and External Audit Logs
Timestamp: 00:35:07 to 00:38:55
Michael Davis argues that runtime authorization should emulate robotics by combining user intent with probabilistic environmental telemetry, such as server patch states and OpenTelemetry spans. Ian Livingstone cites a Hugging Face Squid proxy vulnerability to show why tamper-resistant audit logs and network enforcement must live outside the agent's control.
Significance (Medium): Pairing environmental sensor state with external, tamper-resistant logs ensures organizations can detect exploits and establish legal liability.
Sources in support: Michael Davis (Global Chief Security Architect, JPMorgan Chase), Ian Livingstone (CEO & Co-founder, Keycard), Allie Howe (Member of Technical Staff, Keycard)
12. Dick Hardt and Panelists Debate AI P(doom)
Timestamp: 00:38:57 to 00:43:07
Asked whether AI P(doom) is real, Dick Hardt dismisses sci-fi rogue autonomy but warns that malicious actors or careless insiders wielding powerful agents will cause natural-disaster-scale catastrophes. Michael Davis trusts engineering iteration to solve the risks, while Ian Livingstone argues P(doom) approaches zero because computers can be unplugged and failures teach society.
Significance (Medium): The immediate existential risk is not self-directed AGI takeover, but human bad actors and poorly secured organizations deploying autonomous tools recklessly.
Sources in support: Dick Hardt (Co-creator of OAuth & Creator of AAuth)
Sources against: Ian Livingstone (CEO & Co-founder, Keycard)
Neutral sources: Michael Davis (Global Chief Security Architect, JPMorgan Chase)
This analysis was generated by skim (skim.plus), an AI-powered content analysis platform by Credible AI. Scores and classifications represent the platform's AI-generated assessment and should be considered alongside other sources.
