- Banks authorize the transaction, and a cheque had a memo line for intent. A panel on the AI Engineer show said agents need both.
- Speakers argued that machines cannot be held accountable, so intent is the link back to a human who answers for the outcome.
Banks long ago moved to authorizing the transaction rather than the person. A paper cheque also had a memo line, where the payer wrote the intent. Speakers on the AI Engineer show argued that AI agents need both habits. They also said a record of intent does a second job: it links an agent's actions back to a human. The talk was a keynote panel with people from Keycard, JPMorgan Chase and the co-creator of the OAuth login standard.
What was said
A speaker on the show recalled paper cheques. A cheque had hard limits, such as the amount, the payee and the date. It also had a memo line. In the speaker's words, "that memo field was used to actually tell the intent of what this payment was." Knowing intent, they said, makes a problem easier to debug while it is happening.
Dick Hardt, who created the AAuth protocol, described a "mission": the big-picture job a person gives an agent. A mission identifier follows every action, so later you can audit what happened and why.
The panel used a recent case. An agent booking a table on Resy made so many calls that its user's account was banned. Hardt said old software that retried endlessly was a bug you fixed. An agent may just keep trying until it wins. AAuth therefore adds budgets: access ends when the token expires or the budget runs out.
On blame, one speaker said machines cannot be held to account, so people must be tied to what agents do. A record of intent, they argued, is that tie.
Why it matters
Our reading: the Resy case shows who pays. The agent lost nothing. The user lost an account. If machines cannot answer for themselves, the person or company that deployed the agent will. Buyers and builders should ask a simple question before granting access. Can we show what the agent was asked to do, and what it did? Panelists said a shared record of intent could help firms sort human error from agent error faster, and so contain the damage.
The other side
The panel admitted intent is slippery. Good intent can still lead to a wrong action, as the Resy agent showed. One speaker said finance has clear rules for a wrong payment, while AI has few such rules for when things go wrong. Those rules are still to be built.
The panel did not settle who bears the loss when a human is blamed for an agent's mistake. Keycard's Ian Livingstone called it "a liability question" and said he did not think more regulation was needed. Another speaker worried that standards could favor large players. A record of intent can show who is responsible. It does not decide who pays.
Written by the WebPulse Newsroom with AI assistance, and checked by our editorial review: every quotation was verified against the recording's transcript. How we use AI.
The conversation this talking point comes from
- AI Engineer: An AI Agent Got Its User Banned From Resy — Keycard, JPMorgan Chase & AAuth (2026-10-17)
