Identity Assertion JWT Authorization Grant (ID-JAG) vs OAuth Profile for Delegated AI Agent Authorization (DAAP)
The map lists them as complementary: sites and agents commonly implement both.
| Identity Assertion JWT Authorization Grant ID-JAG | OAuth Profile for Delegated AI Agent Authorization DAAP | |
|---|---|---|
| Lifecycle step | 3 Permit: What may the agent do here? | 3 Permit: What may the agent do here? |
| Answers | How can an app or AI agent, already SSO-federated to a user's enterprise identity provider, obtain scoped access to a third-party API or MCP server without a fresh consent screen at that third party? | How can a human user delegate constrained, attenuable, revocable authority to an AI agent using standard OAuth mechanisms, with no new endpoints or claims required? |
| Governed by | IETF OAuth (Web Authorization Protocol) Working Group; WG Document as of this verification, individual submission originated 2024-03 | IETF individual Internet-Draft (OAuth-adjacent; not yet adopted by the OAuth Working Group as of this verification) |
| Status (issuer's words) | Active Internet-Draft, WG Document (oauth WG); Intended status: Standards Track (per document front matter); IESG state: I-D Exists | Internet-Draft, individual submission, Active |
| Version | draft-ietf-oauth-identity-assertion-authz-grant-04 (replaces the individual draft-parecki-oauth-identity-assertion-authz-grant) (2026-05-21) | draft-mishra-oauth-agent-grants-02 (2026-08-30) |
| Form / transport | endpoint | endpoint |
| Found at | /.well-known/oauth-authorization-server or /.well-known/openid-configuration | /.well-known/oauth-authorization-server |
| Implementation | multi-implementation | prototype |
| Evidence | 3 verified, 3 reported | 2 verified, 1 reported |
| Primary use case | Delegate a user's authority to an agent | Delegate a user's authority to an agent |
| Last verified | 2026-10-23 (current) | 2026-10-23 (current) |
| Specification | https://datatracker.ietf.org/doc/draft-ietf-oauth-identity-assertion-authz-grant/ | https://datatracker.ietf.org/doc/html/draft-mishra-oauth-agent-grants-02 |
When to use which
- Choose Identity Assertion JWT Authorization Grant when your question is “How can an app or AI agent, already SSO-federated to a user's enterprise identity provider, obtain scoped access to a third-party API or MCP server without a fresh consent screen at that third party?” and you accept its maturity: status "Active Internet-Draft, WG Document (oauth WG); Intended status: Standards Track (per document front matter); IESG state: I-D Exists", implementation multi-implementation.
- Choose OAuth Profile for Delegated AI Agent Authorization when your question is “How can a human user delegate constrained, attenuable, revocable authority to an AI agent using standard OAuth mechanisms, with no new endpoints or claims required?” and you accept its maturity: status "Internet-Draft, individual submission, Active", implementation prototype.
Read the full articles
- Identity Assertion JWT Authorization Grant: How can an app or AI agent, already SSO-federated to a user's enterprise identity provider, obtain scoped access to a third-party API or MCP server without a fresh consent screen at that third party?
- OAuth Profile for Delegated AI Agent Authorization: How can a human user delegate constrained, attenuable, revocable authority to an AI agent using standard OAuth mechanisms, with no new endpoints or claims required?