{
 "url": "https://agenticweb.wiki/compare/agent-permissions-json-vs-auth-md/",
 "title": "agent-permissions.json vs auth.md",
 "description": "agent-permissions.json vs auth.md: They sit at the same step and overlap in purpose; the fields above are the basis for choosing. Side-by-side step…",
 "markdown_url": "https://agenticweb.wiki/compare/agent-permissions-json-vs-auth-md/index.md",
 "markdown": "# agent-permissions.json vs auth.md\n\nThey sit at the same step and overlap in purpose; the fields above are the basis for choosing.\n\n[3 Permit](/category/permit/) [agent-permissions.json](/protocols/agent-permissions-json/) · [3 Permit](/category/permit/) [auth.md](/protocols/auth-md/)\n\n|  | [agent-permissions.json](/protocols/agent-permissions-json/) | [auth.md](/protocols/auth-md/) |\n| --- | --- | --- |\n| Lifecycle step | 3 Permit: What may the agent do here? | 3 Permit: What may the agent do here? |\n| Answers | Which page-level interactions (clicking, form submission, file upload, media control, script execution) may an agent perform while driving a web page's UI, as opposed to just fetching it? | How does an AI agent register a new account for its user on a service, without a human filling out a sign-up form or an OAuth redirect flow existing to authorize it? |\n| Governed by | Lightweight Agent Standards Working Group (LAS-WG), an open community project hosted on GitHub at las-wg/agent-permissions.json; no formal standards-body affiliation found | Single vendor (auth-md.com, associated with WorkOS and founder Fabricio Telles); adopted by several named third parties (Resend, Cloudflare, Firecrawl, Alpic, here.now, mailbox.bot) who each publish their own auth.md file |\n| Status (issuer's words) | v1.0.0, complete JSON Schema published; described by the working group's own arXiv paper as a proposal, not an adopted standard | Published protocol specification at auth-md.com/specification; not submitted to IETF, W3C, or any standards body |\n| Version | 1.0.0 (2026-07-17) | Launched 2026-06, current spec undated beyond launch (2026-06) |\n| Form / transport | well-known file | document format |\n| Found at | /.well-known/agent-permissions.json | /auth.md |\n| Implementation | prototype | multi-implementation — auth-md.com, which lists Resend, Cloudflare, Firecrawl, Ora.ai, here.now, mailbox.bot, agents-txt.com, WorkOS, and Alpic as 'already supported' adopters |\n| Evidence | 2 verified, 1 reported | 1 verified, 1 reported |\n| Primary use case | Let agents act on my website | Delegate a user's authority to an agent |\n| Last verified | 2026-10-23 (current) | 2026-10-23 (current) |\n| Specification | [https://github.com/las-wg/agent-permissions.json](https://github.com/las-wg/agent-permissions.json) | [https://auth-md.com/specification](https://auth-md.com/specification) |\n\n## When to use which\n\n- Choose agent-permissions.json when your question is “Which page-level interactions (clicking, form submission, file upload, media control, script execution) may an agent perform while driving a web page's UI, as opposed to just fetching it?” and you accept its maturity: status \"v1.0.0, complete JSON Schema published; described by the working group's own arXiv paper as a proposal, not an adopted standard\", implementation prototype.\n- Choose auth.md when your question is “How does an AI agent register a new account for its user on a service, without a human filling out a sign-up form or an OAuth redirect flow existing to authorize it?” and you accept its maturity: status \"Published protocol specification at auth-md.com/specification; not submitted to IETF, W3C, or any standards body\", implementation multi-implementation (auth-md.com, which lists Resend, Cloudflare, Firecrawl, Ora.ai, here.now, mailbox.bot, agents-txt.com, WorkOS, and Alpic as 'already supported' adopters).\n\nGuidance is derived from the two records (question, status, implementation, prerequisites, pairings), not from opinion. Each record's page carries its numbered references.\n\n## Read the full articles\n\n- [agent-permissions.json](/protocols/agent-permissions-json/): Which page-level interactions (clicking, form submission, file upload, media control, script execution) may an agent perform while driving a web page's UI, as opposed to just fetching it?\n- [auth.md](/protocols/auth-md/): How does an AI agent register a new account for its user on a service, without a human filling out a sign-up form or an OAuth redirect flow existing to authorize it?\n\nAsk the MCP server to compare any two: the compare-protocols prompt, or get on both ids. [Connect](/connect/).\n\n[agent-permissions-json.json](/data/protocols/agent-permissions-json.json) · [auth-md.json](/data/protocols/auth-md.json) · [Markdown](/compare/agent-permissions-json-vs-auth-md/index.md)\n"
}