[authorization]

2026-10-12[writing]

Give an agent a trip to book: the airline up to $500, the hotel up to $600, $1,000 in all, nobody else. I checked whether 42 agent payment products and standards (Visa, Mastercard, Stripe, Coinbase, AWS, AP2 and more) can hold it to that. Three can: MetaMask's Delegation Framework, Rhinestone Smart Sessions and Crossmint's signer scopes. The surprise was the part that sounds easiest: who the agent is allowed to pay.

2026-08-27[writing]

I tried to write down the formula for revocation latency and it kept being wrong in instructive ways. The corrections come from validator source code: a five-minute grace on expired tokens in .NET, streams that outlive their token by design, and a 12-hour JWKS refresh on the one lever that actually works. With runnable experiments.