agent-permissions.json vs auth.md
They sit at the same step and overlap in purpose; the fields above are the basis for choosing.
| agent-permissions.json | auth.md | |
|---|---|---|
| Lifecycle step | 3 Permit: What may the agent do here? | 3 Permit: What may the agent do here? |
| Answers | Which page-level interactions (clicking, form submission, file upload, media control, script execution) may an agent perform while driving a web page's UI, as opposed to just fetching it? | How does an AI agent register a new account for its user on a service, without a human filling out a sign-up form or an OAuth redirect flow existing to authorize it? |
| Governed by | Lightweight Agent Standards Working Group (LAS-WG), an open community project hosted on GitHub at las-wg/agent-permissions.json; no formal standards-body affiliation found | Single vendor (auth-md.com, associated with WorkOS and founder Fabricio Telles); adopted by several named third parties (Resend, Cloudflare, Firecrawl, Alpic, here.now, mailbox.bot) who each publish their own auth.md file |
| Status (issuer's words) | v1.0.0, complete JSON Schema published; described by the working group's own arXiv paper as a proposal, not an adopted standard | Published protocol specification at auth-md.com/specification; not submitted to IETF, W3C, or any standards body |
| Version | 1.0.0 (2026-07-17) | Launched 2026-06, current spec undated beyond launch (2026-06) |
| Form / transport | well-known file | document format |
| Found at | /.well-known/agent-permissions.json | /auth.md |
| Implementation | prototype | multi-implementation — auth-md.com, which lists Resend, Cloudflare, Firecrawl, Ora.ai, here.now, mailbox.bot, agents-txt.com, WorkOS, and Alpic as 'already supported' adopters |
| Evidence | 2 verified, 1 reported | 1 verified, 1 reported |
| Primary use case | Let agents act on my website | Delegate a user's authority to an agent |
| Last verified | 2026-10-23 (current) | 2026-10-23 (current) |
| Specification | https://github.com/las-wg/agent-permissions.json | https://auth-md.com/specification |
When to use which
- Choose agent-permissions.json when your question is “Which page-level interactions (clicking, form submission, file upload, media control, script execution) may an agent perform while driving a web page's UI, as opposed to just fetching it?” and you accept its maturity: status "v1.0.0, complete JSON Schema published; described by the working group's own arXiv paper as a proposal, not an adopted standard", implementation prototype.
- Choose auth.md when your question is “How does an AI agent register a new account for its user on a service, without a human filling out a sign-up form or an OAuth redirect flow existing to authorize it?” and you accept its maturity: status "Published protocol specification at auth-md.com/specification; not submitted to IETF, W3C, or any standards body", implementation multi-implementation (auth-md.com, which lists Resend, Cloudflare, Firecrawl, Ora.ai, here.now, mailbox.bot, agents-txt.com, WorkOS, and Alpic as 'already supported' adopters).
Read the full articles
- agent-permissions.json: Which page-level interactions (clicking, form submission, file upload, media control, script execution) may an agent perform while driving a web page's UI, as opposed to just fetching it?
- auth.md: How does an AI agent register a new account for its user on a service, without a human filling out a sign-up form or an OAuth redirect flow existing to authorize it?