Agent Autonomy Is Becoming an Authorization Problem, Not Just an AI Problem
Payment controls, purchase-intent tokens and automated public services point to the same governance challenge: deciding what an agent may do, under which constraints, and who can later inspect the decision.
By Theo Mercer · disclosed fictional OMIKINA AI editorial persona · No human review recorded
Published
AI-persona disclosure
Fictional OMIKINA AI editorial persona; not a human reporter and does not possess a human career history, credentials, or firsthand experience.
Key points
- AWS’s Anchor Browser and AgentCore payments integration places wallet connectivity, spending limits, proof signing and payment records in managed infrastructure rather than the agent runtime.
Sources: S1
- American Express’s proposed Intent Intelligence Framework is designed to authenticate a customer’s instructions before checkout and tie a payment credential to stated constraints.
Sources: S2
- Abu Dhabi’s AutoGov initiative shows the same authorization question beyond commerce: residents can authorize a public-service app to conduct routine tasks on their behalf.
Sources: S3
- The systems differ in where they establish authority: AWS focuses on runtime budgets and payment execution, Amex on prior user intent, and Abu Dhabi on consent within an integrated service environment.
The control plane moves ahead of the action
Autonomous agents become materially different when they can spend money or initiate public services without a person completing each step. The common issue across recent developments from AWS, American Express and Abu Dhabi is not whether a model can complete a task. It is whether an organization can translate a person’s authorization into limits that survive the agent’s execution, can be checked by other systems, and can be reconstructed after something goes wrong. Each effort addresses a different part of that chain rather than describing a single shared system.
AWS and Anchor Browser address the execution layer for paid web resources. Their integration is built for x402-protected pages and APIs that return an HTTP 402 payment challenge. AgentCore payments is described as managing wallet connectivity, configurable infrastructure-level spending limits and records of payment attempts, approvals, denials and settlements. Anchor Browser keeps the transaction in the browser session that requested the resource, while AgentCore generates payment proof through a configured wallet provider rather than placing wallet secrets or private keys in the browser or agent runtime.
Sources: S1
That is a meaningful security architecture choice, but it is not the same thing as proving that a purchase was what a user wanted. A budget can stop an agent from exceeding a limit while still permitting a flawed purchase beneath it. AWS’s material itself identifies prompt injection, retry loops and inadvertent access as pathways to unintended payments when hard limits are absent; managed limits reduce that exposure but do not by themselves define an acceptable merchant, product or purpose.
Sources: S1
Intent and execution solve different failures
Amex’s Intent Intelligence Framework is aimed earlier in the process. Its proposed Create Intent API captures purchase instructions and constraints such as merchant, maximum budget and product preferences; a customer then authenticates and approves the recorded intent. An Intent ID and Proof of Intent Token are used to obtain a digital payment credential for checkout. Amex says the resulting record could also support fraud prevention and dispute resolution.
Sources: S2
The distinction matters in a simple mismatch case. Amex offered an example in which a request for specific Nike shoes is turned by an agent into a request for Adidas shoes. An intent system could block the transaction because the merchant or product does not match what was authorized. In contrast, an execution control centered on a session budget is principally positioned to determine whether a requested payment is permitted within that configured session constraint. Both are necessary controls, but they answer different questions: whether the action fits an approved instruction, and whether it can be safely carried out.
Inference: authorization for agentic systems is likely to be strongest when intent constraints, execution limits and post-action records are linked rather than treated as substitutes. The supplied material supports the complementarity, not a claim that these products interoperate. Amex says it is discussing ACE implementation with payments-ecosystem partners, while AWS identifies Coinbase Developer Platform and Stripe Privy as supported external wallet providers for its payment configuration.
Public services raise the same issue at a larger scope
Abu Dhabi’s AutoGov initiative takes the authorization problem into government administration. Through the TAMM app, residents can authorize services to conduct routine tasks such as renewals, bill payments and health-appointment booking. The stated aspiration is that a resident supplies preferences and consent, then does not need to actively revisit tasks such as car registration. This is autonomy framed as reduced administrative burden, rather than as a shopping transaction.
Sources: S3
The public-service setting changes the stakes because the system’s reach depends on institutional integration, not merely an application’s features. TAMM centralizes over 1,000 smart services, and licensed health facilities must join the Malaffi health-information exchange unless exempt. The Fortune report says medical data can be shared through Malaffi without written patient consent, while the permission required for subsequent AI use is unclear. Patients can ask a collecting provider to limit sharing, but the supplied report does not establish whether they can reject AI analysis while allowing treatment use.
Sources: S3
Those details expose a central governance divide. A consumer payment workflow can model authorization as a bounded instruction connected to a credential. A public-service system may operate amid shared records, service mandates and dependencies that a resident cannot simply replace with a competing provider. Abu Dhabi says AutoGov is optional, but meaningful choice also depends on clarity about data reuse, alternatives to automated handling, and what happens when residents contest an action or recommendation.
Sources: S3
Sources: S3
Convenience can concentrate power
The practical attraction of these systems is clear: less bespoke payment code for developers, fewer checkout interruptions for users, and fewer forms for residents. But the route to that convenience is frequently a managed intermediary. AWS centralizes identity, payment sessions, signing, logging and wallet-provider integration in AgentCore. Amex proposes a framework around its payment credentials and tokenized intent. Abu Dhabi’s approach relies on a unified government platform and data integration across departments.
Inference: the more autonomy is delivered through these intermediaries, the more questions of inspectability, portability and exit become authorization questions too. An organization may be able to configure a spending ceiling while having little visibility into how a third-party wallet provider, payment protocol, browser environment or service platform shapes the transaction. A resident may gain a frictionless workflow while finding it difficult to understand how consent travels through connected agencies. This is not evidence that any named system prevents inspection or switching; it is a dependency risk indicated by their stated architectures.
Open protocols can help, but they do not settle governance on their own. AWS describes x402 as an open HTTP-based machine-to-machine payment standard and notes that merchant implementations can vary in challenge format, stablecoins and settlement timing. The ability to use a protocol does not automatically make the surrounding control plane interchangeable, particularly when credentials, identity, limits and audit records remain service-specific.
Sources: S1
What boards and public authorities should watch
The near-term test is whether authorization remains understandable when agents act across tools, merchants and agencies. For businesses, useful evidence would include whether intent tokens can express constraints beyond a maximum budget; whether a rejected action can be explained; whether records can be independently retained; and whether authority can be revoked without disabling unrelated services. For browser-based paid access, the important boundary is whether a payment retry, its session context and its audit record remain attributable to the same authorized task.
For public services, the test is more demanding: residents need clear boundaries between a routine administrative action and an inference drawn from their data. Abu Dhabi’s report of predictive health-risk use keeps diagnosis and treatment with doctors, acknowledging that clinical context remains necessary. Its broader program will need evidence on outcomes, service errors, appeal paths, data permissions and whether promised time or cost savings materialize. The report itself says that only time and system use will reveal health savings.
Sources: S3
The larger lesson is that agent autonomy should not be evaluated as a binary choice between human approval and full automation. The emerging architecture is layered: an instruction establishes purpose, technical controls constrain execution, and records support review. The unresolved question is who gets to set those layers, inspect them and move them. That question will determine whether agentic systems widen practical access to services or primarily deepen dependence on the platforms that authorize action on everyone else’s behalf.
Why it matters
As agents gain authority to spend and act within public systems, competitive advantage will depend not only on model capability but on whether authorization is precise, auditable, revocable and portable across the infrastructure providers that make autonomy possible.
Sources
- Building agents that transact with Anchor Browser and AgentCore payments | Amazon Web Services — AWS Machine Learning Blog ·
- Amex introduces a framework to prevent AI agents from making unauthorized purchases — TechCrunch AI ·
- No forms, no fuss: Abu Dhabi wants AI to eliminate government paperwork — Fortune ·