Intent-Based Auth: Why Agent Permissions Need a Mission

The gap that keeps enterprises stuck

An agent can hold a valid API token and still do the wrong thing. That is the whole problem.

At AI Engineer NYC 2026, Allie Howe of Keycard opened a panel by naming the gap precisely: standing access tells you what a system can call, not whether it should call it right now. Authorising a tool call at runtime — in context, against a live mission — is a different decision entirely. Most enterprise auth infrastructure was never designed to make it.

Ian Livingstone, Keycard’s CEO, put it plainly: existing permissions were built for a world where humans made all the decisions and software was deterministic. An agent explores, retries, and finds new routes toward a goal. Dick Hardt, founder of AAuth and co-creator of OAuth, traced the mismatch to OAuth’s origin — a protocol designed to let one website talk to another, assuming registered clients and browser redirects. Copying those coarse scopes into an agentic setting preserves their coarseness. Livingstone noted that Salesforce’s OAuth for a long time offered a single scope: api. In an agent context, that is nearly useless. Watch the opening discussion at 2:17:04.

Michael Davis, Global Chief Security Architect at JPMC, added a practical frame: successful enterprises onboard agents the way they onboard developers. Day-one access is limited; autonomy expands as trust is earned. The agent’s own claim about what it intends is only one input. The environment it runs in, whether it is sandboxed, and what surrounds it all shape the access it should receive.

Why a mission changes the decision

The payment example from the panel makes the stakes concrete. A check carries a payee, an amount, a date, and a memo. Those fields convey both constraints and a reason for acting. Financial systems already authorise transactions, not just identities. But even a valid payment can be wrong: if the agent made the identical payment five seconds earlier, a second one is a duplicate. The decision needs the broader history.

Hardt calls that context a mission in AAuth. A person — a human or an organisation — gives the agent a goal. The agent negotiates the parameters. A mission identifier then follows every subsequent decision, so the organisation can reconstruct what happened and why. The mission must still obey organisational policy: asking an agent to read the CEO’s email cannot grant access the requester never had. Hardt separates the worker from the component supervising its permissions so the agent cannot approve its own access.

Livingstone draws a line between two distinct layers of intent. Business intent is why a company adopted an agent — say, to make developers more productive. Immediate task intent is what a specific session is trying to accomplish — fixing a bug in staging. Permissions should reflect the intersection of those two purposes. Davis cautions that the intersection is not static: reading an executive’s email means something different when the requester is that executive’s administrative assistant. Mission tracking across weeks-long workflows is, as Davis noted, early work rather than a capability already deployed everywhere.

Commerce, supervision, and who controls the guardrails

Agentic commerce exposes the problem from both sides. A buyer wants an agent to choose the right item within a budget. A merchant wants to know who sent the agent, whether to trust it, and what it is trying to do. Livingstone compares this to the longstanding problem of an unfamiliar client arriving at a website: anti-abuse systems must distinguish useful activity from spam, while agents need a way to interact without every site treating them as unwanted automation. Identity and agreed protocols give a resource owner more information for that decision.

Hardt’s deeper concern is who controls supervision. If the vendor supplying the worker also decides every permission, the user cannot easily substitute a supervisor implementing their own policy. Interoperable protocols would let those components come from different providers. Livingstone argues for a federated web where resource owners decide what they allow using shared standards, rather than a system that gives a few large providers privileged entry. Davis adds the accountability layer: connecting intent to outcome makes it easier to assign responsibility when real money moves.

Mission context also clarifies failure modes after the fact. The same audit record can help an investigator distinguish three distinct problems:

A harmful request: the agent carried out a goal the user should never have pursued.
A misunderstanding: the agent acted on the wrong interpretation of the goal.
An execution error: the software performed the wrong operation.

Without mission context, investigators have only the agent’s post-hoc explanation.

Budgets, sandboxes, and toxic combinations

Good intent does not guarantee proportionate behaviour. Howe described a restaurant-reservation incident in which an agent’s repeated requests reportedly caused an account to be banned. The agent was trying to complete a legitimate task; persistence became abuse. Watch the budget discussion at 2:41:10.

Hardt’s response in AAuth is resource budgets. A token can expire after a period of time or after its budget is exhausted. Once the budget is gone, supervision decides whether to grant more. The difference from traditional rate limiting: the agent receives continuous feedback on how much budget remains and can adjust its behaviour before hitting a hard cutoff. It knows the constraint is real.

Livingstone describes the architectural pattern: a sandbox contains tools, while an egress proxy outside it enforces authorisation. Keeping powerful credentials out of the sandbox reduces the chance the agent discovers and reuses them through an unintended path. Davis warns that separation alone is incomplete. Stored memory can bias later decisions, and combinations of otherwise reasonable tools can create dangerous capabilities — what Davis calls toxic combinations. One practical response is to remove tools dynamically during a task: disable external egress while an email operation is underway, then restore it when the mission changes. Constraining available tools also reduces irrelevant exploration and, in practice, can improve agent performance.

The audit log must live outside the agent

Davis imagines intent context appearing alongside a trace span, so an engineer can inspect both the user’s intention and the environmental conditions at the time of any action. Authorisation decisions become shorter-lived and better-informed as those conditions change.

Livingstone is direct about one requirement: the audit log must remain outside the worker’s control. An agent that can tamper with the only record of its own behaviour undermines every investigation that follows. The record — who requested an action, for what purpose, which operations followed — is also a prerequisite for holding responsible parties accountable. Livingstone frames this as a liability question rather than a regulation question. Pre-existing liability law asks who employed the agent and who is responsible for the damage. The tamper-resistant log is how you answer it.

The panel closed on honest disagreement. The proposed authorisation systems can constrain a worker serving an approved mission inside a responsible organisation. Whether those controls can contain people deliberately using agents to cause harm is a separate, unresolved question — and the one the panel’s most cautious voice considers the real risk. Watch the closing exchange at 2:55:15.

Where to start

Enterprise mission tracking is early. Most organisations do not yet have it. But the architectural decisions made today — sandbox boundaries, egress proxy placement, credential separation, log ownership — determine how quickly intent-based controls can be added as the tooling matures.

Pick one production agent workflow and map every standing permission it holds. Identify the coarsest scope. Then ask a specific question: would a mission identifier have distinguished the last unexpected action it took from a legitimate one? That exercise surfaces the gap between what the agent is allowed to do and what it should have done, and gives security and application teams a shared vocabulary to close it.

Eagentix helps growth-focused enterprises redesign and automate manual business processes. We combine executive strategy, implementation support, and managed services to build dependable operations across Southeast Asia.

Sources

Watch “Intent Based Auth — conference livestream” on YouTube
2:16:23–2:59:38 on YouTube
2:17:04 ↗
2:21:52 ↗
2:32:55 ↗
2:41:10 ↗
2:47:47 ↗
2:55:15 ↗
2:16:24
2:16:25
2:16:27
2:16:29
2:16:30
2:16:31
2:16:34
2:16:37
2:16:38
2:16:41
2:16:44
2:16:47
2:16:52
2:17:00
2:17:12
2:17:15
2:17:20
2:17:25
2:17:30
2:17:36
2:17:41
2:17:47
2:17:53
2:18:00
2:18:03
2:18:04
2:18:06
2:18:10
2:18:14
2:18:18
2:18:22
2:18:24
2:18:27
2:18:28
2:18:31
2:18:32
2:18:35
2:18:37
2:18:38
2:18:40
2:18:43
2:18:46
2:18:49
2:18:52
2:18:54
2:18:56
2:18:58
2:19:02
2:19:05
2:19:09
2:19:13
2:19:19
2:19:23
2:19:26
2:19:32
2:19:36
2:19:39
2:19:40
2:19:42
2:19:47
2:19:50
2:19:53
2:19:54
2:19:56
2:19:59
2:20:04
2:20:09
2:20:11
2:20:15
2:20:18
2:20:20
2:20:23
2:20:25
2:20:28
2:20:32
2:20:35
2:20:37
2:20:42
2:20:46
2:20:50
2:20:53
2:20:57
2:21:02
2:21:07
2:21:12
2:21:16
2:21:21
2:21:25
2:21:29
2:21:32
2:21:35
2:21:39
2:21:42
2:21:45
2:21:49
2:21:53
2:21:54
2:21:57
2:22:02
2:22:05
2:22:08
2:22:09
2:22:11
2:22:16
2:22:21
2:22:23
2:22:25
2:22:26
2:22:29
2:22:30
2:22:33
2:22:35
2:22:36
2:22:39
2:22:40
2:22:42
2:22:45
2:22:46
2:22:48
2:22:50
2:22:56
2:23:01
2:23:08
2:23:13
2:23:17
2:23:19
2:23:21
2:23:24
2:23:31
2:23:38
2:23:45
2:23:48
2:23:52
2:23:56
2:23:58
2:24:00
2:24:02
2:24:04
2:24:07
2:24:10
2:24:12
2:24:17
2:24:19
2:24:21
2:24:25
2:24:30
2:24:33
2:24:34
2:24:35
2:24:39
2:24:42
2:24:45
2:24:50
2:24:51
2:24:55
2:24:57
2:25:02
2:25:09
2:25:10
2:25:15
2:25:16
2:25:18
2:25:22
2:25:24
2:25:26
2:25:28
2:25:29
2:25:32
2:25:36
2:25:40
2:25:43
2:25:47
2:25:53
2:25:56
2:26:01
2:26:06
2:26:14
2:26:19
2:26:22
2:26:28
2:26:33
2:26:37
2:26:44
2:26:48
2:26:54
2:27:05
2:27:08
2:27:16
2:27:18
2:27:22
2:27:24
2:27:29
2:27:34
2:27:39
2:27:40
2:27:45
2:27:47
2:27:52
2:27:57
2:27:59
2:28:04
2:28:13
2:28:17
2:28:20
2:28:22
2:28:23
2:28:25
2:28:27
2:28:30
2:28:32
2:28:33
2:28:36
2:28:37
2:28:39
2:28:41
2:28:44
2:28:46
2:28:47
2:28:49
2:28:55
2:28:57
2:29:02
2:29:05
2:29:08
2:29:12
2:29:14
2:29:16
2:29:19
2:29:21
2:29:23
2:29:26
2:29:28
2:29:29
2:29:31
2:29:33
2:29:35
2:29:37
2:29:39
2:29:40
2:29:43
2:29:45
2:29:47
2:29:50
2:29:53
2:29:55
2:29:56
2:29:59
2:30:03
2:30:04
2:30:06
2:30:08
2:30:12
2:30:16
2:30:18
2:30:20
2:30:23
2:30:24
2:30:25
2:30:29
2:30:30
2:30:32
2:30:36
2:30:38
2:30:40
2:30:42
2:30:44
2:30:46
2:30:48
2:30:50
2:30:53
2:30:54
2:30:56
2:30:58
2:31:01
2:31:02
2:31:04
2:31:07
2:31:11
2:31:14
2:31:17
2:31:21
2:31:25
2:31:29
2:31:31
2:31:35
2:31:40
2:31:46
2:31:50
2:31:55
2:31:59
2:32:05
2:32:07
2:32:09
2:32:11
2:32:13
2:32:15
2:32:17
2:32:19
2:32:21
2:32:22
2:32:25
2:32:26
2:32:28
2:32:30
2:32:33
2:32:34
2:32:37
2:32:38
2:32:40
2:32:43
2:32:44
2:32:46
2:32:48
2:32:50
2:32:53
2:32:56
2:32:58
2:33:00
2:33:02
2:33:04
2:33:07
2:33:10
2:33:12
2:33:15
2:33:17
2:33:19
2:33:21
2:33:24
2:33:30
2:33:48
2:33:52
2:33:55
2:33:59
2:34:04
2:34:08
2:34:11
2:34:13
2:34:18
2:34:21
2:34:23
2:34:24
2:34:27
2:34:30
2:34:32
2:34:34
2:34:35
2:34:37
2:34:40
2:34:42
2:34:43
2:34:46
2:34:52
2:34:56
2:35:00
2:35:01
2:35:04
2:35:08
2:35:10
2:35:14
2:35:16
2:35:21
2:35:22
2:35:24
2:35:29
2:35:34
2:35:35
2:35:39
2:35:41
2:35:46
2:35:47
2:35:51
2:35:53
2:35:57
2:36:00
2:36:05
2:36:09
2:36:14
2:36:15
2:36:21
2:36:24
2:36:27
2:36:35
2:36:37
2:36:40
2:36:41
2:36:44
2:36:50
2:36:55
2:36:58
2:37:04
2:37:07
2:37:09
2:37:12
2:37:14
2:37:17
2:37:19
2:37:23
2:37:26
2:37:29
2:37:33
2:37:36
2:37:39
2:37:42
2:37:43
2:37:46
2:37:49
2:37:51
2:37:54
2:37:55
2:38:00
2:38:03
2:38:04
2:38:09
2:38:13
2:38:17
2:38:21
2:38:25
2:38:29
2:38:33
2:38:35
2:38:37
2:38:39
2:38:43
2:38:46
2:38:49
2:38:52
2:38:53
2:38:55
2:38:58
2:39:00
2:39:02
2:39:04
2:39:06
2:39:08
2:39:10
2:39:11
2:39:13
2:39:15
2:39:17
2:39:18
2:39:19
2:39:22
2:39:24
2:39:25
2:39:28
2:39:29
2:39:31
2:39:34
2:39:35
2:39:38
2:39:42
2:39:45
2:39:48
2:39:50
2:39:52
2:39:54
2:39:57
2:39:59
2:40:02
2:40:05
2:40:09
2:40:12
2:40:15
2:40:18
2:40:19
2:40:22
2:40:25
2:40:28
2:40:33
2:40:37
2:40:41
2:40:46
2:40:51
2:40:54
2:40:56
2:40:59
2:41:00
2:41:03
2:41:04
2:41:06
2:41:12
2:41:14
2:41:16
2:41:19
2:41:20
2:41:22
2:41:24
2:41:30
2:41:36
2:41:39
2:41:44
2:41:48
2:41:52
2:41:57
2:42:02
2:42:09
2:42:15
2:42:20
2:42:24
2:42:29
2:42:35
2:42:37
2:42:42
2:42:48
2:42:51
2:42:55
2:42:57
2:43:00
2:43:04
2:43:05
2:43:07
2:43:11
2:43:15
2:43:18
2:43:23
2:43:46
2:43:48
2:43:51
2:43:52
2:43:54
2:43:56
2:43:58
2:44:00
2:44:02
2:44:04
2:44:06
2:44:08
2:44:10
2:44:12
2:44:16
2:44:19
2:44:20
2:44:22
2:44:24
2:44:26
2:44:28
2:44:30
2:44:31
2:44:34
2:44:36
2:44:38
2:44:40
2:44:42
2:44:44
2:44:47
2:44:48
2:44:49
2:44:52
2:44:54
2:44:56
2:44:58
2:45:00
2:45:02
2:45:04
2:45:06
2:45:08
2:45:10
2:45:13
2:45:14
2:45:17
2:45:19
2:45:20
2:45:22
2:45:26
2:45:29
2:45:31
2:45:32
2:45:35
2:45:37
2:45:39
2:45:41
2:45:43
2:45:45
2:45:47
2:45:49
2:45:51
2:45:53
2:45:55
2:45:57
2:45:59
2:46:01
2:46:03
2:46:05
2:46:07
2:46:09
2:46:11
2:46:13
2:46:15
2:46:17
2:46:19
2:46:21
2:46:23
2:46:25
2:46:27
2:46:29
2:46:31
2:46:33
2:46:35
2:46:37
2:46:39
2:46:41
2:46:44
2:46:47
2:46:51
2:46:56
2:46:59
2:47:03
2:47:07
2:47:14
2:47:18
2:47:19
2:47:24
2:47:30
2:47:34
2:47:37
2:47:41
2:47:52
2:47:57
2:48:00
2:48:03
2:48:05
2:48:07
2:48:10
2:48:11
2:48:13
2:48:16
2:48:17
2:48:19
2:48:22
2:48:25
2:48:26
2:48:29
2:48:31
2:48:33
2:48:34
2:48:36
2:48:37
2:48:38
2:48:41
2:48:43
2:48:45
2:48:47
2:48:48
2:48:50
2:48:51
2:48:52
2:48:53
2:48:56
2:48:59
2:49:06
2:49:08
2:49:13
2:49:19
2:49:23
2:49:24
2:49:28
2:49:30
2:49:33
2:49:35
2:49:37
2:49:39
2:49:42
2:49:44
2:49:46
2:49:49
2:49:51
2:49:53
2:49:56
2:49:59
2:50:01
2:50:05
2:50:07
2:50:09
2:50:12
2:50:14
2:50:16
2:50:17
2:50:19
2:50:21
2:50:24
2:50:30
2:50:34
2:50:36
2:50:40
2:50:45
2:50:46
2:50:49
2:50:52
2:50:57
2:51:01
2:51:04
2:51:08
2:51:13
2:51:18
2:51:25
2:51:30
2:51:31
2:51:35
2:51:37
2:51:38
2:51:42
2:51:44
2:51:49
2:51:51
2:51:57
2:52:04
2:52:06
2:52:12
2:52:14
2:52:16
2:52:17
2:52:23
2:52:29
2:52:31
2:52:36
2:52:40
2:52:46
2:52:52
2:52:57
2:53:01
2:53:05
2:53:09
2:53:18
2:53:21
2:53:23
2:53:24
2:53:29
2:53:31
2:53:35
2:53:36
2:53:40
2:53:42
2:53:47
2:53:53
2:53:55
2:53:58
2:54:03
2:54:06
2:54:10
2:54:13
2:54:17
2:54:21
2:54:26
2:54:31
2:54:36
2:54:40
2:54:41
2:54:46
2:54:48
2:54:52
2:54:57
2:54:59
2:55:04
2:55:06
2:55:09
2:55:10
2:55:14
2:55:18
2:55:22
2:55:24
2:55:28
2:55:29
2:55:31
2:55:33
2:55:35
2:55:37
2:55:38
2:55:41
2:55:43
2:55:45
2:55:47
2:55:49
2:55:54
2:55:56
2:56:01
2:56:03
2:56:04
2:56:08
2:56:10
2:56:11
2:56:14
2:56:16
2:56:18
2:56:19
2:56:22
2:56:25
2:56:26
2:56:28
2:56:29
2:56:32
2:56:34
2:56:36
2:56:41
2:56:44
2:56:46
2:56:50
2:56:54
2:56:57
2:57:01
2:57:02
2:57:09
2:57:13
2:57:16
2:57:20
2:57:24
2:57:29
2:57:36
2:57:41
2:57:49
2:57:54
2:57:56
2:57:58
2:58:00
2:58:02
2:58:05
2:58:06
2:58:08
2:58:10
2:58:12
2:58:16
2:58:17
2:58:19
2:58:22
2:58:23
2:58:27
2:58:30
2:58:33
2:58:36
2:58:38
2:58:40
2:58:42
2:58:45
2:58:48
2:58:50
2:58:51
2:58:56
2:58:58
2:58:59
2:59:01
2:59:08
2:59:09
2:59:12
2:59:17
2:59:19
2:59:23
2:59:26
2:59:30
2:59:34
2:59:35