# Agent Authorization Grant vs Identity Assertion JWT Authorization Grant

The map lists them as complementary: sites and agents commonly implement both.

[3 Permit](/category/permit/) [Agent Authorization Grant](/protocols/aauth/) · [3 Permit](/category/permit/) [Identity Assertion JWT Authorization Grant](/protocols/identity-assertion-authz-grant/)

|  | [Agent Authorization Grant](/protocols/aauth/) AAuth | [Identity Assertion JWT Authorization Grant](/protocols/identity-assertion-authz-grant/) ID-JAG |
| --- | --- | --- |
| Lifecycle step | 3 Permit: What may the agent do here? | 3 Permit: What may the agent do here? |
| Answers | How can a conversational AI agent, reached over a channel without browser redirect (phone, SMS), obtain a properly scoped OAuth access token without impersonating the user? | How can an app or AI agent, already SSO-federated to a user's enterprise identity provider, obtain scoped access to a third-party API or MCP server without a fresh consent screen at that third party? |
| Governed by | IETF individual Internet-Draft (OAuth-adjacent, not yet adopted by the OAuth Working Group as of this verification) | IETF OAuth (Web Authorization Protocol) Working Group; WG Document as of this verification, individual submission originated 2024-03 |
| Status (issuer's words) | Expired Internet-Draft (expired 2026-04-23) | Active Internet-Draft, WG Document (oauth WG); Intended status: Standards Track (per document front matter); IESG state: I-D Exists |
| Phase | deprecated | working group |
| Version | draft-rosenberg-oauth-aauth-01 (2026-04-22) | draft-ietf-oauth-identity-assertion-authz-grant-04 (replaces the individual draft-parecki-oauth-identity-assertion-authz-grant) (2026-05-21) |
| Form / transport | endpoint | endpoint |
| Found at | OAuth 2.1 extension grant flow; no well-known file defined | /.well-known/oauth-authorization-server or /.well-known/openid-configuration |
| Adoption | unmeasured | observed |
| Evidence | 5 verified | 3 verified, 3 reported |
| Primary use case | Delegate a user's authority to an agent | Delegate a user's authority to an agent |
| Last verified | 2026-10-18 (current) | 2026-10-18 (current) |
| Specification | [https://datatracker.ietf.org/doc/html/draft-rosenberg-oauth-aauth](https://datatracker.ietf.org/doc/html/draft-rosenberg-oauth-aauth) | [https://datatracker.ietf.org/doc/draft-ietf-oauth-identity-assertion-authz-grant/](https://datatracker.ietf.org/doc/draft-ietf-oauth-identity-assertion-authz-grant/) |

## When to use which

- Choose Agent Authorization Grant when your question is “How can a conversational AI agent, reached over a channel without browser redirect (phone, SMS), obtain a properly scoped OAuth access token without impersonating the user?” and you accept its maturity: phase deprecated, adoption unmeasured. It is no longer maintained; prefer its successor.
- Choose Identity Assertion JWT Authorization Grant when your question is “How can an app or AI agent, already SSO-federated to a user's enterprise identity provider, obtain scoped access to a third-party API or MCP server without a fresh consent screen at that third party?” and you accept its maturity: phase working group, adoption observed.

Guidance is derived from the two records (question, phase, adoption, prerequisites, pairings), not from opinion. Each record's page carries its numbered references.

## Read the full articles

- [Agent Authorization Grant](/protocols/aauth/): How can a conversational AI agent, reached over a channel without browser redirect (phone, SMS), obtain a properly scoped OAuth access token without impersonating the user?
- [Identity Assertion JWT Authorization Grant](/protocols/identity-assertion-authz-grant/): How can an app or AI agent, already SSO-federated to a user's enterprise identity provider, obtain scoped access to a third-party API or MCP server without a fresh consent screen at that third party?

Ask the MCP server to compare any two: the compare-protocols prompt, or get on both ids. [Connect](/connect/).

[aauth.json](/data/protocols/aauth.json) · [identity-assertion-authz-grant.json](/data/protocols/identity-assertion-authz-grant.json) · [Markdown](/compare/aauth-vs-identity-assertion-authz-grant/index.md)