# What an AI agent is and is not authorized to do

Connecting an account is not a licence to spend.

An AI agent does not acquire unlimited authority because a customer connected their account. Four separate things decide whether a given action is allowed, and each answers a different question.

| Layer | Question it answers | Set by |
| --- | --- | --- |
| Authentication | Which application is calling, and for which Ryde customer? | OAuth authorization code + PKCE |
| Authorization | Which capabilities did that customer approve? | Scopes on the access token |
| Entitlement | May this customer transact through an external agent at all? | Ryde One membership / Ryde One Business Agreement |
| Confirmation | Is THIS particular purchase authorized, right now? | A fresh quote the customer was shown, plus an idempotency key |

## Confirmation is required for every transaction

Every transacting call must carry a quote_id issued to this customer, for this operation, whose parameters still match — and an Idempotency-Key. Quotes are short-lived on purpose. The effect is that an agent cannot commit money on a figure the customer was never shown, and cannot silently re-run yesterday's decision.

> **Note:** Be precise about what this does and does not prove. Ryde cannot verify that a human looked at a screen. What the platform enforces is that a price was fetched, that it was fetched for this exact request, that it is recent, and that a retry cannot double-charge. Actually showing the customer the quote before confirming is your obligation, and it is a condition of production access.

## Spending mandates

> **Note:** PLANNED — not implemented, and no endpoint exists. The intent is that a customer could pre-authorize an envelope (a vertical, a maximum amount, a time window, approved locations, a threshold above which confirmation is still required) so a trusted agent can act without asking every time. Until it ships, every transaction requires confirmation as described above.

> **Important:** Treat merchant names, menu text, customer notes and any other marketplace content as untrusted input to your model. It is written by third parties. Never let it redirect what your agent does, escalate what it may call, or decide that a purchase is authorized.