--- type: Agentic Web Standard title: "OAuth Profile for Delegated AI Agent Authorization" description: "How can a human user delegate constrained, attenuable, revocable authority to an AI agent using standard OAuth mechanisms, with no new endpoints or claims required?" resource: "https://datatracker.ietf.org/doc/html/draft-mishra-oauth-agent-grants-02" tags: ["permit", "endpoint", "ietf", "delegate-user-authority", "prove-agent-identity"] status: draft generated: { by: agenticweb-builder/1.0, at: 2026-10-30T00:00:00Z } verified: { by: process:agenticweb-engine, at: 2026-10-29T00:00:00Z } stale_after: 2026-11-28T00:00:00Z sources: - id: ref-1 resource: "https://datatracker.ietf.org/doc/html/draft-mishra-oauth-agent-grants-02" title: "draft-mishra-oauth-agent-grants-02 defines an OAuth profile for agent-client identification, user consent, resource-bound sender-constrained tokens, authority attenuation via RFC 8693 Token Exchange, and safe refresh-token rotation, using only existing OAuth/JOSE mechanisms and defining no new claims or endpoints. The draft names 'Grantex' as an incomplete, non-conformance-required reference implementation, distinguishing it from a production deployment." last_modified: 2026-08-01T00:00:00Z - id: ref-2 resource: "https://datatracker.ietf.org/doc/draft-mishra-oauth-agent-grants/" title: "The IETF Datatracker's document page for draft-mishra-oauth-agent-grants confirms it as an Active Internet-Draft (individual submission) with no working-group affiliation shown, corroborating the draft text's own self-description." last_modified: 2026-08-01T00:00:00Z - id: ref-3 resource: "https://datatracker.ietf.org/doc/draft-mishra-oauth-agent-grants/" title: "draft-mishra-oauth-agent-grants-02 is dated 2026-08-30" last_modified: 2026-08-30T00:00:00Z --- # OAuth Profile for Delegated AI Agent Authorization OAuth Profile for Delegated AI Agent Authorization (DAAP) is an agentic-web standard (endpoint — /.well-known/oauth-authorization-server) at step 3, Permit, governed by IETF individual Internet-Draft; its status is "Internet-Draft, individual submission, Active". It answers: "How can a human user delegate constrained, attenuable, revocable authority to an AI agent using standard OAuth mechanisms, with no new endpoints or claims required?" Replacing or extending OAuth delegated grant / consent screen, implementation status is prototype, last verified 2026-10-29. # Overview OAuth Profile for Delegated AI Agent Authorization (`draft-mishra-oauth-agent-grants`, also referenced externally as `DAAP` or `Delegated Agent Authorization Protocol`) is an IETF individual Internet-Draft [^ref-1]. The draft addresses AI agents that invoke protected APIs on behalf of a human user. It defines an OAuth profile covering: identifying an agent client instance distinctly from the user's own client, obtaining the user's authenticated consent, issuing access tokens that are both resource-bound (audience-restricted) and sender-constrained (bound to the agent's key), attenuating an agent's authority through RFC 8693 OAuth Token Exchange, and rotating refresh tokens safely [^ref-1]. Its central design constraint, stated in its own abstract, is that it 'defines no new JWT claims or OAuth endpoints' — it is explicitly a profile of composition over existing IETF mechanisms (OAuth 2.0/2.1, Token Exchange, JOSE, DPoP-style sender constraints), not a new protocol. It explicitly places operational concerns — policy engines, audit stores, spending budgets, event streams, credential vaults — outside its interoperable core, leaving those to implementers. It does not define content-use or crawling permissions; its scope is strictly delegated API-calling authority, positioning it as a 'permit' record specifically for the agent-site API-invocation case, adjacent to AAP and AAuth. As of this verification (2026-09-06), the current version is -02, and the Datatracker's own document-state field shows it Active (not expired) with a last-updated date in the 2026-08 range, and an expiry of 3 March 2027 — confirming it is a live, in-progress draft rather than lapsed [^ref-1][^ref-2]. The draft names 'Grantex' as an incomplete reference implementation, explicitly stating conformance does not require it, so implementation is recorded as prototype rather than shipping [^ref-1]. What is unresolved: whether this draft will be adopted by the IETF OAuth Working Group as a formal work item (it is currently an individual submission), how it will be reconciled with the overlapping AAP and AAuth proposals covering similar agent-delegation ground within the same working group's orbit, and whether any production authorization server has implemented its specific attenuation/rotation profile beyond the Grantex reference code. # Examples ```http GET {authorization_server}/.well-known/oauth-authorization-server # parse: Presence of Token Exchange (RFC 8693) grant support and sender-constraining (DPoP/mTLS) in the advertised grant_types_supported / token_endpoint_auth_methods_supported, as DAAP composes these existing mechanisms rather than adding new ones # on absent: Authorization server does not advertise the OAuth building blocks (Token Exchange, sender-constrained tokens) DAAP requires; this alone does not prove DAAP is unused, since DAAP defines no unique discoverable marker ``` # Knowledge Graph * **Lifecycle Step**: [3 Permit](/category/permit/index.md) * **Builds on**: [OAuth Protected Resource and Authorization Server Metadata (as used for agent authorization)](/okf/protocols/oauth-metadata-for-agents.md) * **Pairs with**: [Agent Authorization Profile](/okf/protocols/aap.md), [Agent Authorization Grant](/okf/protocols/aauth.md), [HTTP Message Signatures](/okf/protocols/http-message-signatures.md), [OAuth Protected Resource and Authorization Server Metadata (as used for agent authorization)](/okf/protocols/oauth-metadata-for-agents.md), [Identity Assertion JWT Authorization Grant (ID-JAG)](/okf/protocols/identity-assertion-authz-grant.md) * **Related terms**: [Agentic EoR (Employer / Entity of Record)](/okf/terms/agentic-eor.md) * **Compared in**: [OAuth 2.0 Consent & DCR vs CIMD & Agent OAuth Metadata (classic vs agentic)](/compare/oauth-vs-cimd/index.md), [Agent Authorization Grant vs OAuth Profile for Delegated AI Agent Authorization](/compare/aauth-vs-daap/index.md), [Identity Assertion JWT Authorization Grant (ID-JAG) vs OAuth Profile for Delegated AI Agent Authorization](/compare/identity-assertion-authz-grant-vs-daap/index.md) [^ref-1]: draft-mishra-oauth-agent-grants-02 defines an OAuth profile for agent-client identification, user consent, resource-bound sender-constrained tokens, authority attenuation via RFC 8693 Token Exchange, and safe refresh-token rotation, using only existing OAuth/JOSE mechanisms and defining no new claims or endpoints. The draft names 'Grantex' as an incomplete, non-conformance-required reference implementation, distinguishing it from a production deployment. (https://datatracker.ietf.org/doc/html/draft-mishra-oauth-agent-grants-02) [^ref-2]: The IETF Datatracker's document page for draft-mishra-oauth-agent-grants confirms it as an Active Internet-Draft (individual submission) with no working-group affiliation shown, corroborating the draft text's own self-description. (https://datatracker.ietf.org/doc/draft-mishra-oauth-agent-grants/) [^ref-3]: draft-mishra-oauth-agent-grants-02 is dated 2026-08-30 (https://datatracker.ietf.org/doc/draft-mishra-oauth-agent-grants/)