PayPal engineer on AI commerce: when it works, how it pays

This article summarizes an episode of AI Engineer’s video series featuring Ben Cooms, PayPal engineer.

Photo credit: Shutterstock

AI agents that shop on their own break traditional checkout security. This is because human approval must now happen before shopping begins and stay attached to the AI.

Ben Coumes, an engineer at PayPal, and Jay Mok, a software developer at PayPal, are finding new ways to manage this change. They are doing this by adjusting security levels, using closed platforms to build trust quickly, and using cryptographic tokens to secure purchases on the open web.

Authorization thresholds must scale with agent risk

To adjust these security levels, Mock developed a framework treating AI permissions as a sliding scale of risk rather than a binary lock. Security teams must abandon uniform protocols and match the burden to the financial stakes:

• Task reversibility: Simple actions demand fewer hurdles than financial transfers.
• Time-bound permissions: AI agents require operational windows that systems can verify mid-process.
• Independent verification: External purchases need proof structures that merchants can audit without centralized help.

As Mock puts it, teams must ask, “did the human authorize this? Is the action allowed right now, in this scope, and can we prove it later?”

Closed networks commoditize agent trust

While proving user consent across the open web is challenging, confining these risk variables to a single software ecosystem simplifies the burden of agent-to-agent commerce by centralizing trust:

• Buyers and sellers bypass the open internet to operate under one rule set.
• Platforms utilize OAuth to grant merchants access to payment vaults without exposing credentials.
• Engineers can rely on internal transaction logs for dispute resolution instead of cryptography.

In a joint test between PayPal and the Nevermind platform, transactions ran through this shared environment instead of the open web.

Cooms notes that because both parties act within the same system, they are “borrowing trust from Nevermind to make sure the buying agent is acting within the instructions a human gave it.”

Cryptographic layers secure open web transactions

Closed networks simplify trust because every party uses the same system. Shopping on the open web, however, requires a digital pass proving the AI has permission to spend money. Cooms explains that PayPal uses specialized security tokens that reveal only necessary details to each merchant.

To maintain financial security across disconnected platforms, this architecture allows systems to:

• Authenticate in stages. A provider creates the foundation before the user and the agent sign their permission layers.
• Isolate critical data. Segmented disclosure ensures merchants only verify checkout accuracy while processors authenticate the payment mandate.
• Operate without relationships. Open standards ensure that no one involved in the transaction is forced to maintain a partnership with vendors.