Field notes from PayPal’s AI Innovation Meetup, where a talk about token efficiency kept routing toward a harder question: not whether agents are capable, but whether they are permitted.
I came to PayPal’s San Jose campus for the tooling, a session pitched on cutting token burn with context plugins for Claude, Cursor & VS Code. The mechanics were the draw. The longer the night ran, the less it was about cost && the more it was about a precondition nobody on stage fully answered:
Before an agent can buy anything, who decides it is allowed to?
Harness has a vocabulary
Lead Technical Product Manager Mark Lummus opened by naming the layers of an agentic stack rather than selling a product. MCP for live connectivity. CLI for local execution. Skills for encoded instruction. The skills layer he framed as portable memory, best practices written once into rules files and carried across whichever model happens to be hot this month. Rules can also overrule stale training data outright: PayPal has shipped APIs for twenty years, and most of what a model absorbed about them is obsolete, so a rule says ignore that, use this instead.
His sharpest moment was a limit, not a feature. The CLI is fully deterministic, he said, a backstop placed under the model precisely because
“you will never get rid of the probabilistic nature” of what sits above it.
Guardrails are not decoration. They are the part of the system permitted to be certain.
APIMatic.io founder & CEO S. Adeel Ali supplied the economic frame. An agent dropped into a versioned payments API without grounding invents namespaces and order flows, then ships a checkout that marks an order paid without ever capturing the money. The fix is not a smarter model. It is context delivered as a contract.
“When the model becomes a commodity, context is a comparative advantage,” Ali said.
Context, though, is not free. Feeding live API schemas into a prompt raises input tokens per call. The trade is deliberate: across four codebases, two production-grade and two reference apps, the grounded agent stopped thrashing, so total session burn fell by roughly two-thirds even as each prompt carried more. The grounded agent spends tokens to stop wasting them.
PayPal senior product manager Nathaniel O. Olson, who ran the night’s live demo, turned the principle into a habit. His demo made the point physical: a context plugin loaded over MCP, a three-line prompt and a working checkout that built its own tests. When an agent returns the wrong thing, his advice runs, resist re-prompting and repair the scaffold instead.
“You have to sit down and watch it fail”
he told the room, then encode the missing context once so the failure cannot recur. The work moves upstream, where security, governance, context and observability stop being afterthoughts bolted onto the model and become the product itself.
Capability was never the binding constraint. Coherence is.
Mark’s stack hides the rest of the argument too. A probabilistic model on top, a deterministic rail underneath. Hold that image, because it scales.
Same shape, larger scale
An agent without API context loses the edge-case machinery an SDK quietly encodes: retries, auth handshakes, the refund path nobody demos. Now widen the aperture. A model standing between a buyer and a seller loses a different machinery, the one a merchant spent a decade building: tax calculation, address validation, shipping callbacks, fraud checks, insurance and the upsell at checkout. Same failure mode, one level up.
The agent here is the buyer’s delegate, software dispatched to transact on a person’s behalf, not an enterprise procurement bot or a merchant-side assistant. That puts it on the opposite side of the table from everyone who built the checkout.
Another PayPal colleague in the room, Badi Azad mapped the problem from a recent Anthropic dinner that gathered the commerce industry across a few tables, Stripe and Adyen near him, Walmart and Shopify across the room. The open question there, he said, was where a model is even permitted to stand. Google never sold anything; it read intent and routed the buyer to the destination that fit, and commerce happened downstream, intact.
The newer pattern tries to complete the purchase inside the assistant, which “disassociates the buyer from the seller” and strands everything that downstream machinery exists to do.
His concrete tell came from PayPal’s own flows. In the Shopify integration the sale does not finish inside PayPal. The buyer taps agree and continue and is redirected back to Shopify, because Shopify wants the buyer inside its own ecosystem of shipping, tracking and add-ons rather than handed off mid-funnel. Every platform along that road is fighting for the same stretch of it. Drop an autonomous agent into the middle and the fight does not vanish. It loses the participant who understood the terrain.
Azad’s guess at the endgame is worth holding as a guess. The first real money may not come from closing sales at all. It may come from placement: assistants as brand ambassadors, paid to surface one merchant over another, an AI-native echo of search advertising. A college friend of his already runs a startup measuring how brands appear inside model answers, discovery now and monetized recommendation later. By his read the dinner’s host seemed content to stay on the developer side and leave the buy unsolved, and OpenAI, having tried it, had backed away from owning it.
There is a counter-reading the panel left implicit. Some of that merchant machinery is not service, it is friction: the pre-checked add-on, the manufactured urgency, the upsell engineered against the buyer’s interest. An agent that strips it is not destroying value so much as declining it. Whose machinery, serving whom, is the governance question hiding under the commerce question.
Identity is not authority
The night’s most pointed exchange came from the floor: could an agent carry something like a FICO score, a portable measure of identity, reputation and risk? Lummus declined to answer fully and Azad jumped in to clarify. Azad set the current boundary. PayPal’s focus stays on routing agent commerce through existing merchant rails, and those rails, he said, are still very much the same. A merchant needs a previously established processing account; the agent passes its commerce action through machinery built for humans. Room exists to extend that toward delegated authority, an agent acting on someone’s behalf, “but we’re not there yet.” Lummus, listening, agreed it was what he thought too.
Strip the exchange to its parts and four distinct layers fall out, usually fused in conversation and worth holding apart. Identity is who or what sent the action. Authority is who permitted it to act. Reputation is how it has behaved over time. Liability is who pays when it fails. The room had language for the first and ambition for the rest.
The verification layer is already being built, barely. A Trulioo representative, Srini Vadhri, described a certification process for agents and a coming layer of agent directories, then conceded the same word: early. What exists today is thinner than the ambition. Asked how a hijacked session token gets stopped before a rogue agent turns a hundred-thousand-dollar invoice into a million, Lummus pointed to transaction signing, public and private keys, an encrypted element passed with every call so the sender cannot be forged. Real, but narrow. It proves a message’s origin. It does not vet the agent that sent it.
Identity here is not a profile, it is a credential: a verifiable cryptographic mark an agent carries and a seller can check. A credential answers who. It does not answer who is responsible.
Trust has no rail yet
That last question is the one with no infrastructure behind it.
A merchant has no contract to enforce against a software loop that hallucinates a six-figure commitment. There is no party to sue, no account to suspend, no human whose authority was delegated on the record. This is the quiet reason PayPal keeps a human-shaped entity on the hook: a registered merchant, on rails already governed, accountable in ways an autonomous buyer is not.
Context solved competence. Liability is a different layer, and it does not yield to better prompting. Identity and reputation can be issued, scored and revoked. Liability has to be assigned, assumed, enforced, insured or adjudicated, and none of that machinery exists yet for a buyer made of software. Until it does, every serious agent purchase routes back through a human or a human-backed merchant, which is exactly what makes the rails feel unchanged.
Closing
I walked in to learn how context plugins cut token burn. I left holding the question the panels kept circling without naming.
Commerce is not withholding agency from agents because the models are weak. It is withholding agency until identity, authority and liability become machine-readable. The probabilistic model can already shop. The deterministic rail underneath has not decided to let it pay on its own.
So when the agent is the buyer, who owns the last mile of the transaction, the behavioral stretch where trust, tax and authority resolve? And the sharper version underneath: what reputation infrastructure must exist before an agent deserves to buy at all? Token efficiency is solved by better context. This is not.
It gets solved, if at all, by rails built for machine buyers from the start, where identity, reputation and settlement are designed for agents rather than retrofitted around the humans they stand in for.
On that, the room was unanimous and plain.
Not yet.
The race is to define what yet looks like.