{
 "id": "aauth-r3",
 "name": "AAuth Rich Resource Requests",
 "acronym": "R3",
 "aliases": [
  "AAuth R3",
  "Rich Resource Requests"
 ],
 "collisions": [],
 "step": "permit",
 "parties": [
  "agent-site",
  "agent-human"
 ],
 "form": "endpoint",
 "track": "ietf",
 "scope": "general",
 "question": "How can an agent request an API's named operations, and a person approve one exact call, without relying on opaque scope strings?",
 "analog": "OAuth Rich Authorization Requests (RAR)",
 "origin": {
  "org": "Dick Hardt (Hellō)",
  "date": "2026-09-28"
 },
 "governance": "Individual IETF Internet-Draft submission, companion to the AAuth Protocol; no working group.",
 "native_status": "Exploratory Draft (-00); no known implementations",
 "phase": "draft",
 "implementation": "none-found",
 "adoption": {
  "level": "unmeasured",
  "by": null,
  "probe_run": null
 },
 "version": {
  "label": "draft-hardt-aauth-r3-00",
  "date": "2026-09-28"
 },
 "spec_url": "https://datatracker.ietf.org/doc/html/draft-hardt-aauth-r3-00",
 "discovery": {
  "mechanism": "Resource advertises supported operation vocabularies as r3_vocabularies; a resource token carries r3_uri and r3_s256 pointing at the R3 document",
  "path": null
 },
 "probe": {
  "method": "NONE",
  "path": "",
  "parse": "",
  "on_absent": ""
 },
 "evidence": [
  {
   "claim": "Individual-submission companion to the AAuth Protocol by Dick Hardt (Hellō); -00, marked Exploratory Draft, no known implementations. It replaces scope strings with resource-named operations in vocabularies (MCP, OpenAPI, gRPC, GraphQL, AsyncAPI, WSDL, OData), content-addressed R3 documents identified by SHA-256, and per-call proposals.",
   "label": "REPORTED",
   "url": "https://insights.bostonidentity.com/research/ietf-datatracker-2026-09-28-aauth-rich-resource-requests",
   "date": "2026-09-28"
  },
  {
   "claim": "Datatracker shows draft-hardt-aauth-r3-00, dated 2026-09-28, expires 2027-04-01",
   "label": "VERIFIED",
   "url": "https://datatracker.ietf.org/doc/draft-hardt-aauth-r3/",
   "date": "2026-09-28",
   "retrieved_at": "2026-10-16T05:02:29Z",
   "source_type": "standards-body",
   "http_status": 200,
   "content_sha256": "2a362a61b49b8a914872cf8258b6b7cdf1d385cc8a27b84b9fc65f24555e55f6",
   "detector": "ietf@1.0"
  }
 ],
 "summary_md": "AAuth R3 is an individual IETF draft by Dick Hardt that extends AAuth so an agent can request named operations from a vocabulary the resource advertises, rather than scope strings. The resource describes the operations in a JSON R3 document identified by its SHA-256 hash, which the person's server shows for consent. The issuer places the granted operations and hash in the auth token, and the resource enforces from the token alone. For operations marked per-call, a single-use token is bound to the call's concrete parameters. The draft has no known implementations and defines no consent screen or revocation.",
 "part_of": "aauth",
 "group": null,
 "candidate": true,
 "confidence": 0.6,
 "use_cases": [
  "let-agents-act-on-my-site",
  "delegate-user-authority"
 ],
 "audience": [
  "platform",
  "agent-builder",
  "standards-body"
 ],
 "pairs_with": [
  "aauth",
  "aauth-hardt",
  "mcp"
 ],
 "prerequisites": [
  "aauth"
 ],
 "dispute": null,
 "last_verified": "2026-10-18",
 "history": [
  {
   "date": "2026-10-16",
   "note": "auto-drafted candidate from exa (https://insights.bostonidentity.com/research/ietf-datatracker-2026-09-28-aauth-rich-resource-requests)"
  },
  {
   "date": "2026-10-16",
   "note": "spec_url moved from the Boston Identity write-up to the Internet-Draft draft-hardt-aauth-r3-00; ietf watch added"
  },
  {
   "date": "2026-10-16",
   "note": "revision -00 → 00 (watcher)"
  }
 ],
 "watch": [
  {
   "type": "ietf",
   "doc": "draft-hardt-aauth-r3"
  }
 ],
 "freshness": "current"
}