Ilya Vinokurov

Yes, actually I have found a solution; at least it works for me. The idea is laid out in detail here: https://blog.iluxav.com/the-attack-was-authorized-the-missing-security-boundary-for-ai-agents TLDR; User vendor access key with its scopes belongs to the actual user and is hidden from AI agents. Instead, there are cryptographically derived keys that can only narrow down the permissions and ONLY with the user's explicit consent for a short period of time. The approval flow works via OpenAI elicitation protocol that pops the consent in the chat, or it could be done externally via Slack, Teams, emails - whatever

Good question. I think both are practical building blocks today, especially Biscuit for agent workflows. But neither understands human intent by itself. A trusted broker still needs to turn approval into a narrowly scoped token: this action, on this resource, within this time and budget. So I’d say the cryptography is ready; the surrounding product layer is still early. The difficult parts are approval UX, translating intent into exact constraints, revocation, and audit. Macaroons or Biscuit could be part of the solution, but not the whole solution.