--- type: Agentic Web Standard title: "Agent Authorization Grant" description: "How can a conversational AI agent, reached over a channel without browser redirect (phone, SMS), obtain a properly scoped OAuth access token without impersonating the user?" resource: "https://datatracker.ietf.org/doc/html/draft-rosenberg-oauth-aauth" tags: ["permit", "endpoint", "ietf", "delegate-user-authority", "prove-agent-identity"] status: deprecated generated: { by: agenticweb-builder/1.0, at: 2026-10-30T00:00:00Z } verified: { by: process:agenticweb-engine, at: 2026-10-23T00:00:00Z } stale_after: 2026-11-22T00:00:00Z sources: - id: ref-1 resource: "https://datatracker.ietf.org/doc/html/draft-rosenberg-oauth-aauth" title: "draft-rosenberg-oauth-aauth defines an OAuth 2.1 extension letting an AI agent collect PII conversationally (over PSTN or texting, where redirect-based OAuth is unavailable) and exchange it for a scope-constrained access token, with an explicit goal of preventing LLM-hallucination-driven impersonation." last_modified: 2025-10-19T00:00:00Z - id: ref-2 resource: "https://www.ietf.org/archive/id/draft-rosenberg-oauth-aauth-00.html" title: "The raw draft-00 HTML text hosted at ietf.org/archive (distinct from the Datatracker's metadata/history page) confirms the same abstract, scope (PSTN/texting channels, PII-collection flow, anti-impersonation goal) and lets the Datatracker's 'Expired' state be cross-checked against the actual spec content rather than taken on the metadata page alone." last_modified: 2025-10-19T00:00:00Z - id: ref-3 resource: "https://datatracker.ietf.org/doc/draft-rosenberg-oauth-aauth/" title: "draft-rosenberg-oauth-aauth-01 (2026-04-22) expired on 2026-04-23; the active AAuth lineage is draft-hardt-oauth-aauth-protocol-11" last_modified: 2026-04-23T00:00:00Z - id: ref-4 resource: "https://datatracker.ietf.org/doc/draft-hardt-oauth-aauth-protocol/" title: "draft-rosenberg-oauth-aauth-01 (2026-04-22) expired on 2026-04-23; the active AAuth lineage is draft-hardt-oauth-aauth-protocol-11" last_modified: 2026-04-23T00:00:00Z - id: ref-5 resource: "https://datatracker.ietf.org/doc/draft-rosenberg-oauth-aauth/" title: "Expired Internet-Draft (expired 2026-04-23)" last_modified: 2025-10-20T00:00:00Z --- # Agent Authorization Grant Agent Authorization Grant (AAuth) is an agentic-web standard (endpoint) at step 3, Permit, governed by IETF individual Internet-Draft; its status is "Expired Internet-Draft". It answers: "How can a conversational AI agent, reached over a channel without browser redirect (phone, SMS), obtain a properly scoped OAuth access token without impersonating the user?" Replacing or extending OAuth Device Authorization Grant, implementation status is none found, last verified 2026-10-23. # Overview The Agent Authorization Grant (AAuth) is an individual IETF Internet-Draft, draft-rosenberg-oauth-aauth-01 (dated 2026-04-22, succeeding -00 of 2025-10-19 and expired 2026-04-23), proposing an OAuth 2.1 extension for a specific class of AI agent: one reached through a channel that does not support browser-redirect OAuth flows, such as a phone call over the PSTN or SMS texting [^ref-1]. It solves a narrow but real permit-adjacent problem — authorization, not content-use permission — for voice/text-only conversational agents. In the flow it describes, the agent collects personally identifying information from the user through natural-language conversation, then presents that collected PII to obtain an access token with an appropriately constrained scope, rather than redirecting the user to a login page it cannot render over a phone call. The draft's stated primary concern is architectural: ensuring that LLM hallucination inside the agent cannot itself cause an impersonation attack against the authorization flow [^ref-1]. It does not define a well-known discovery file, a permission vocabulary, or content-use semantics — it is purely an authorization-grant flow, adjacent to this wiki's 'identify' and 'permit' steps rather than a pure fit for either. It does not specify a concrete `grant_type` string or endpoint schema in enough detail in the sections reviewed to build an executable, generic probe; a probe would need to be implementation-specific. The IETF Datatracker shows `draft-rosenberg-oauth-aauth-01` (published 2026-04-22 after `-00` of 2025-10-19) as an expired Internet-Draft (expired 2026-04-23), while active AAuth specification work in the OAuth ecosystem has continued in Dick Hardt's `draft-hardt-oauth-aauth-protocol` series (tracked under `aauth-hardt`). No independent implementation, reference server, or adopting product of Rosenberg's PSTN/SMS PII-collection grant was located, so implementation is recorded as none-found and this record's phase is set to withdrawn. What is unresolved: whether the author (Jonathan Rosenberg) or another party intends to revive this line of work, and whether its PII-collection-then-token-exchange pattern will instead be absorbed into a more general draft such as DAAP or AAP, which address overlapping agent-authorization ground within the same OAuth ecosystem. # Examples ```http POST {authorization_server}/token with grant_type indicating the Agent Authorization Grant (exact grant_type string not fixed in the draft text reviewed) # parse: A 200 response containing an access_token issued via the collected-PII flow described in the draft # on absent: Authorization server does not implement this grant; this is expected, since the draft is expired and no implementation was found ``` # Knowledge Graph * **Lifecycle Step**: [3 Permit](/category/permit/index.md) * **Components**: [AAuth Rich Resource Requests](/okf/protocols/aauth-r3.md) * **Depended on by**: [AAuth Rich Resource Requests](/okf/protocols/aauth-r3.md) * **Pairs with**: [OAuth Profile for Delegated AI Agent Authorization](/okf/protocols/daap.md), [Agent Authorization Profile](/okf/protocols/aap.md), [AI Agent Authentication and Authorization](/okf/protocols/aiagent-auth.md), [OAuth Protected Resource and Authorization Server Metadata (as used for agent authorization)](/okf/protocols/oauth-metadata-for-agents.md), [Identity Assertion JWT Authorization Grant (ID-JAG)](/okf/protocols/identity-assertion-authz-grant.md), [AAuth Rich Resource Requests](/okf/protocols/aauth-r3.md) * **Related terms**: [Expired Internet-Draft](/okf/terms/expired-internet-draft.md) * **Compared in**: [OAuth 2.0 Consent & DCR vs CIMD & Agent OAuth Metadata (classic vs agentic)](/compare/oauth-vs-cimd/index.md), [Agent Authorization Grant vs Identity Assertion JWT Authorization Grant (ID-JAG)](/compare/aauth-vs-identity-assertion-authz-grant/index.md), [Agent Authorization Grant vs AAuth (Hardt)](/compare/aauth-vs-aauth-hardt/index.md), [Agent Authorization Grant vs OAuth Profile for Delegated AI Agent Authorization](/compare/aauth-vs-daap/index.md) [^ref-1]: draft-rosenberg-oauth-aauth defines an OAuth 2.1 extension letting an AI agent collect PII conversationally (over PSTN or texting, where redirect-based OAuth is unavailable) and exchange it for a scope-constrained access token, with an explicit goal of preventing LLM-hallucination-driven impersonation. (https://datatracker.ietf.org/doc/html/draft-rosenberg-oauth-aauth) [^ref-2]: The raw draft-00 HTML text hosted at ietf.org/archive (distinct from the Datatracker's metadata/history page) confirms the same abstract, scope (PSTN/texting channels, PII-collection flow, anti-impersonation goal) and lets the Datatracker's 'Expired' state be cross-checked against the actual spec content rather than taken on the metadata page alone. (https://www.ietf.org/archive/id/draft-rosenberg-oauth-aauth-00.html) [^ref-3]: draft-rosenberg-oauth-aauth-01 (2026-04-22) expired on 2026-04-23; the active AAuth lineage is draft-hardt-oauth-aauth-protocol-11 (https://datatracker.ietf.org/doc/draft-rosenberg-oauth-aauth/) [^ref-4]: draft-rosenberg-oauth-aauth-01 (2026-04-22) expired on 2026-04-23; the active AAuth lineage is draft-hardt-oauth-aauth-protocol-11 (https://datatracker.ietf.org/doc/draft-hardt-oauth-aauth-protocol/) [^ref-5]: Expired Internet-Draft (expired 2026-04-23) (https://datatracker.ietf.org/doc/draft-rosenberg-oauth-aauth/)