{
 "url": "https://agenticweb.wiki/compare/identity-assertion-authz-grant-vs-daap/",
 "title": "ID-JAG vs DAAP: differences & adoption",
 "description": "Identity Assertion JWT Authorization Grant vs OAuth Profile for Delegated AI Agent Authorization: The map lists them as complementary: sites and agents…",
 "markdown_url": "https://agenticweb.wiki/compare/identity-assertion-authz-grant-vs-daap/index.md",
 "markdown": "# Identity Assertion JWT Authorization Grant (ID-JAG) vs OAuth Profile for Delegated AI Agent Authorization (DAAP)\n\nThe map lists them as complementary: sites and agents commonly implement both.\n\n[3 Permit](/category/permit/) [Identity Assertion JWT Authorization Grant](/protocols/identity-assertion-authz-grant/) · [3 Permit](/category/permit/) [OAuth Profile for Delegated AI Agent Authorization](/protocols/daap/)\n\n|  | [Identity Assertion JWT Authorization Grant](/protocols/identity-assertion-authz-grant/) ID-JAG | [OAuth Profile for Delegated AI Agent Authorization](/protocols/daap/) DAAP |\n| --- | --- | --- |\n| Lifecycle step | 3 Permit: What may the agent do here? | 3 Permit: What may the agent do here? |\n| Answers | How can an app or AI agent, already SSO-federated to a user's enterprise identity provider, obtain scoped access to a third-party API or MCP server without a fresh consent screen at that third party? | How can a human user delegate constrained, attenuable, revocable authority to an AI agent using standard OAuth mechanisms, with no new endpoints or claims required? |\n| Governed by | IETF OAuth (Web Authorization Protocol) Working Group; WG Document as of this verification, individual submission originated 2024-03 | IETF individual Internet-Draft (OAuth-adjacent; not yet adopted by the OAuth Working Group as of this verification) |\n| Status (issuer's words) | Active Internet-Draft, WG Document (oauth WG); Intended status: Standards Track (per document front matter); IESG state: I-D Exists | Internet-Draft, individual submission, Active |\n| Version | draft-ietf-oauth-identity-assertion-authz-grant-04 (replaces the individual draft-parecki-oauth-identity-assertion-authz-grant) (2026-05-21) | draft-mishra-oauth-agent-grants-02 (2026-08-30) |\n| Form / transport | endpoint | endpoint |\n| Found at | /.well-known/oauth-authorization-server or /.well-known/openid-configuration | /.well-known/oauth-authorization-server |\n| Implementation | multi-implementation | prototype |\n| Evidence | 3 verified, 3 reported | 2 verified, 1 reported |\n| Primary use case | Delegate a user's authority to an agent | Delegate a user's authority to an agent |\n| Last verified | 2026-10-23 (current) | 2026-10-23 (current) |\n| Specification | [https://datatracker.ietf.org/doc/draft-ietf-oauth-identity-assertion-authz-grant/](https://datatracker.ietf.org/doc/draft-ietf-oauth-identity-assertion-authz-grant/) | [https://datatracker.ietf.org/doc/html/draft-mishra-oauth-agent-grants-02](https://datatracker.ietf.org/doc/html/draft-mishra-oauth-agent-grants-02) |\n\n## When to use which\n\n- Choose Identity Assertion JWT Authorization Grant when your question is “How can an app or AI agent, already SSO-federated to a user's enterprise identity provider, obtain scoped access to a third-party API or MCP server without a fresh consent screen at that third party?” and you accept its maturity: status \"Active Internet-Draft, WG Document (oauth WG); Intended status: Standards Track (per document front matter); IESG state: I-D Exists\", implementation multi-implementation.\n- Choose OAuth Profile for Delegated AI Agent Authorization when your question is “How can a human user delegate constrained, attenuable, revocable authority to an AI agent using standard OAuth mechanisms, with no new endpoints or claims required?” and you accept its maturity: status \"Internet-Draft, individual submission, Active\", implementation prototype.\n\nGuidance is derived from the two records (question, status, implementation, prerequisites, pairings), not from opinion. Each record's page carries its numbered references.\n\n## Read the full articles\n\n- [Identity Assertion JWT Authorization Grant](/protocols/identity-assertion-authz-grant/): How can an app or AI agent, already SSO-federated to a user's enterprise identity provider, obtain scoped access to a third-party API or MCP server without a fresh consent screen at that third party?\n- [OAuth Profile for Delegated AI Agent Authorization](/protocols/daap/): How can a human user delegate constrained, attenuable, revocable authority to an AI agent using standard OAuth mechanisms, with no new endpoints or claims required?\n\nAsk the MCP server to compare any two: the compare-protocols prompt, or get on both ids. [Connect](/connect/).\n\n[identity-assertion-authz-grant.json](/data/protocols/identity-assertion-authz-grant.json) · [daap.json](/data/protocols/daap.json) · [Markdown](/compare/identity-assertion-authz-grant-vs-daap/index.md)\n"
}