Agent Authorization Grant (AAuth) vs AAuth (Hardt)
The map lists them as complementary: sites and agents commonly implement both. They share the acronym AAuth but are unrelated protocols.
| Agent Authorization Grant AAuth | AAuth (Hardt) AAuth | |
|---|---|---|
| Lifecycle step | 3 Permit: What may the agent do here? | 3 Permit: What may the agent do here? |
| Answers | How can a conversational AI agent, reached over a channel without browser redirect (phone, SMS), obtain a properly scoped OAuth access token without impersonating the user? | How does an agent obtain and present authorisation to act at a resource, using signed HTTP requests? |
| Governed by | IETF individual Internet-Draft (OAuth-adjacent, not yet adopted by the OAuth Working Group as of this verification) | IETF Internet-Draft by Dick Hardt |
| Status (issuer's words) | Expired Internet-Draft (expired 2026-04-23) | Active Internet-Draft, draft-hardt-oauth-aauth-protocol-11 (2026-09-25, expires 2027-03-29); the companion draft-hardt-aauth-headers-00 (2026-10-04) is marked Expired by the Datatracker |
| Version | draft-rosenberg-oauth-aauth-01 (2026-04-22) | draft-hardt-oauth-aauth-protocol-11 (2026-09-25) |
| Form / transport | endpoint | HTTP header |
| Found at | OAuth 2.1 extension grant flow; no well-known file defined | not determined from the datatracker listing |
| Implementation | none found | none found |
| Evidence | 5 verified | 4 verified |
| Primary use case | Delegate a user's authority to an agent | Prove an agent's identity |
| Last verified | 2026-10-23 (current) | 2026-10-23 (current) |
| Specification | https://datatracker.ietf.org/doc/html/draft-rosenberg-oauth-aauth | https://datatracker.ietf.org/doc/draft-hardt-oauth-aauth-protocol/ |
When to use which
- Choose Agent Authorization Grant when your question is “How can a conversational AI agent, reached over a channel without browser redirect (phone, SMS), obtain a properly scoped OAuth access token without impersonating the user?” and you accept its maturity: status "Expired Internet-Draft (expired 2026-04-23)", implementation none found. It is no longer maintained; prefer its successor.
- Choose AAuth (Hardt) when your question is “How does an agent obtain and present authorisation to act at a resource, using signed HTTP requests?” and you accept its maturity: status "Active Internet-Draft, draft-hardt-oauth-aauth-protocol-11 (2026-09-25, expires 2027-03-29); the companion draft-hardt-aauth-headers-00 (2026-10-04) is marked Expired by the Datatracker", implementation none found.
Read the full articles
- Agent Authorization Grant: How can a conversational AI agent, reached over a channel without browser redirect (phone, SMS), obtain a properly scoped OAuth access token without impersonating the user?
- AAuth (Hardt): How does an agent obtain and present authorisation to act at a resource, using signed HTTP requests?