{
 "url": "https://agenticweb.wiki/compare/aauth-vs-aauth-hardt/",
 "title": "Agent Authorization Grant vs AAuth (Hardt)",
 "description": "Agent Authorization Grant vs AAuth (Hardt): The map lists them as complementary: sites and agents commonly implement both. Side-by-side step, governance…",
 "markdown_url": "https://agenticweb.wiki/compare/aauth-vs-aauth-hardt/index.md",
 "markdown": "# Agent Authorization Grant (AAuth) vs AAuth (Hardt)\n\nThe map lists them as complementary: sites and agents commonly implement both. They share the acronym AAuth but are unrelated protocols.\n\n[3 Permit](/category/permit/) [Agent Authorization Grant](/protocols/aauth/) · [3 Permit](/category/permit/) [AAuth (Hardt)](/protocols/aauth-hardt/)\n\n|  | [Agent Authorization Grant](/protocols/aauth/) AAuth | [AAuth (Hardt)](/protocols/aauth-hardt/) AAuth |\n| --- | --- | --- |\n| Lifecycle step | 3 Permit: What may the agent do here? | 3 Permit: What may the agent do here? |\n| Answers | How can a conversational AI agent, reached over a channel without browser redirect (phone, SMS), obtain a properly scoped OAuth access token without impersonating the user? | How does an agent obtain and present authorisation to act at a resource, using signed HTTP requests? |\n| Governed by | IETF individual Internet-Draft (OAuth-adjacent, not yet adopted by the OAuth Working Group as of this verification) | IETF Internet-Draft by Dick Hardt |\n| Status (issuer's words) | Expired Internet-Draft (expired 2026-04-23) | Active Internet-Draft, draft-hardt-oauth-aauth-protocol-11 (2026-09-25, expires 2027-03-29); the companion draft-hardt-aauth-headers-00 (2026-10-04) is marked Expired by the Datatracker |\n| Version | draft-rosenberg-oauth-aauth-01 (2026-04-22) | draft-hardt-oauth-aauth-protocol-11 (2026-09-25) |\n| Form / transport | endpoint | HTTP header |\n| Found at | OAuth 2.1 extension grant flow; no well-known file defined | not determined from the datatracker listing |\n| Implementation | none found | none found |\n| Evidence | 5 verified | 4 verified |\n| Primary use case | Delegate a user's authority to an agent | Prove an agent's identity |\n| Last verified | 2026-10-23 (current) | 2026-10-23 (current) |\n| Specification | [https://datatracker.ietf.org/doc/html/draft-rosenberg-oauth-aauth](https://datatracker.ietf.org/doc/html/draft-rosenberg-oauth-aauth) | [https://datatracker.ietf.org/doc/draft-hardt-oauth-aauth-protocol/](https://datatracker.ietf.org/doc/draft-hardt-oauth-aauth-protocol/) |\n\n## When to use which\n\n- Choose Agent Authorization Grant when your question is “How can a conversational AI agent, reached over a channel without browser redirect (phone, SMS), obtain a properly scoped OAuth access token without impersonating the user?” and you accept its maturity: status \"Expired Internet-Draft (expired 2026-04-23)\", implementation none found. It is no longer maintained; prefer its successor.\n- Choose AAuth (Hardt) when your question is “How does an agent obtain and present authorisation to act at a resource, using signed HTTP requests?” and you accept its maturity: status \"Active Internet-Draft, draft-hardt-oauth-aauth-protocol-11 (2026-09-25, expires 2027-03-29); the companion draft-hardt-aauth-headers-00 (2026-10-04) is marked Expired by the Datatracker\", implementation none found.\n\nGuidance is derived from the two records (question, status, implementation, prerequisites, pairings), not from opinion. Each record's page carries its numbered references.\n\n## Read the full articles\n\n- [Agent Authorization Grant](/protocols/aauth/): How can a conversational AI agent, reached over a channel without browser redirect (phone, SMS), obtain a properly scoped OAuth access token without impersonating the user?\n- [AAuth (Hardt)](/protocols/aauth-hardt/): How does an agent obtain and present authorisation to act at a resource, using signed HTTP requests?\n\nAsk the MCP server to compare any two: the compare-protocols prompt, or get on both ids. [Connect](/connect/).\n\n[aauth.json](/data/protocols/aauth.json) · [aauth-hardt.json](/data/protocols/aauth-hardt.json) · [Markdown](/compare/aauth-vs-aauth-hardt/index.md)\n"
}