2 posts tagged with "OPA"

An AI agent presents a valid JWT and asks an internal finance API to create a payment. The identity is authentic. The token is unexpired. The route is permitted by the agent's role.

Should the request execute?

An AI agent sends this request:

POST /v1/customers/1287/refunds
Authorization: Bearer eyJ...
Content-Type: application/json

{
  "amount": 1200,
  "reason": "Customer reported duplicate charge"
}