# agent-permissions.json vs auth.md

They sit at the same step and overlap in purpose; the fields above are the basis for choosing.

[3 Permit](/category/permit/) [agent-permissions.json](/protocols/agent-permissions-json/) · [3 Permit](/category/permit/) [auth.md](/protocols/auth-md/)

|  | [agent-permissions.json](/protocols/agent-permissions-json/) | [auth.md](/protocols/auth-md/) |
| --- | --- | --- |
| Lifecycle step | 3 Permit: What may the agent do here? | 3 Permit: What may the agent do here? |
| Answers | Which page-level interactions (clicking, form submission, file upload, media control, script execution) may an agent perform while driving a web page's UI, as opposed to just fetching it? | How does an AI agent register a new account for its user on a service, without a human filling out a sign-up form or an OAuth redirect flow existing to authorize it? |
| Governed by | Lightweight Agent Standards Working Group (LAS-WG), an open community project hosted on GitHub at las-wg/agent-permissions.json; no formal standards-body affiliation found | Single vendor (auth-md.com, associated with WorkOS and founder Fabricio Telles); adopted by several named third parties (Resend, Cloudflare, Firecrawl, Alpic, here.now, mailbox.bot) who each publish their own auth.md file |
| Status (issuer's words) | v1.0.0, complete JSON Schema published; described by the working group's own arXiv paper as a proposal, not an adopted standard | Published protocol specification at auth-md.com/specification; not submitted to IETF, W3C, or any standards body |
| Version | 1.0.0 (2026-07-17) | Launched 2026-06, current spec undated beyond launch (2026-06) |
| Form / transport | well-known file | document format |
| Found at | /.well-known/agent-permissions.json | /auth.md |
| Implementation | prototype | multi-implementation — auth-md.com, which lists Resend, Cloudflare, Firecrawl, Ora.ai, here.now, mailbox.bot, agents-txt.com, WorkOS, and Alpic as 'already supported' adopters |
| Evidence | 2 verified, 1 reported | 1 verified, 1 reported |
| Primary use case | Let agents act on my website | Delegate a user's authority to an agent |
| Last verified | 2026-10-23 (current) | 2026-10-23 (current) |
| Specification | [https://github.com/las-wg/agent-permissions.json](https://github.com/las-wg/agent-permissions.json) | [https://auth-md.com/specification](https://auth-md.com/specification) |

## When to use which

- Choose agent-permissions.json when your question is “Which page-level interactions (clicking, form submission, file upload, media control, script execution) may an agent perform while driving a web page's UI, as opposed to just fetching it?” and you accept its maturity: status "v1.0.0, complete JSON Schema published; described by the working group's own arXiv paper as a proposal, not an adopted standard", implementation prototype.
- Choose auth.md when your question is “How does an AI agent register a new account for its user on a service, without a human filling out a sign-up form or an OAuth redirect flow existing to authorize it?” and you accept its maturity: status "Published protocol specification at auth-md.com/specification; not submitted to IETF, W3C, or any standards body", implementation multi-implementation (auth-md.com, which lists Resend, Cloudflare, Firecrawl, Ora.ai, here.now, mailbox.bot, agents-txt.com, WorkOS, and Alpic as 'already supported' adopters).

Guidance is derived from the two records (question, status, implementation, prerequisites, pairings), not from opinion. Each record's page carries its numbered references.

## Read the full articles

- [agent-permissions.json](/protocols/agent-permissions-json/): Which page-level interactions (clicking, form submission, file upload, media control, script execution) may an agent perform while driving a web page's UI, as opposed to just fetching it?
- [auth.md](/protocols/auth-md/): How does an AI agent register a new account for its user on a service, without a human filling out a sign-up form or an OAuth redirect flow existing to authorize it?

Ask the MCP server to compare any two: the compare-protocols prompt, or get on both ids. [Connect](/connect/).

[agent-permissions-json.json](/data/protocols/agent-permissions-json.json) · [auth-md.json](/data/protocols/auth-md.json) · [Markdown](/compare/agent-permissions-json-vs-auth-md/index.md)