{
 "acronym": "AAP",
 "adoption": {
  "by": null,
  "level": "unmeasured",
  "probe_run": null
 },
 "aliases": [],
 "analog": "OAuth profile / scoped service-account token",
 "collisions": [
  "AAP also collides with the unrelated Automated Access Point / Advanced Authoring Program acronyms in other domains",
  "Agent Attribution Protocol (AAP)"
 ],
 "discovery": {
  "mechanism": "OAuth 2.0 authorization-server metadata plus structured JWT claims; no dedicated well-known file defined in the spec text reviewed",
  "path": null
 },
 "dispute": {
  "claims": [
   "IETF Datatracker: Expired Internet-Draft (individual), IESG state Expired",
   "aapspec/spec repository shows zero stars and no post-launch activity"
  ],
  "summary": "The spec is an expired, single-author IETF individual submission with no working-group adoption and a stalled companion GitHub project; it is retained as a documented proposal rather than an active or governed spec."
 },
 "evidence": [
  {
   "claim": "The IETF Datatracker's document page for draft-aap-oauth-profile shows Document Type 'Expired Internet-Draft (individual)', IESG state 'Expired', last updated 2026-08-11, author 'angel cruz' with a note that the author's listed e-mail may no longer be valid.",
   "date": "2026-08-11",
   "label": "VERIFIED",
   "url": "https://datatracker.ietf.org/doc/draft-aap-oauth-profile/"
  },
  {
   "claim": "The aapspec/spec GitHub repository hosts the same spec under an Apache 2.0 license, links a separate reference-impl repository, and its own README's IETF-status checklist shows no item beyond draft submission checked off, with zero GitHub stars and no commits after the 2026-02-07 draft date.",
   "date": "2026-02-07",
   "label": "REPORTED",
   "url": "https://github.com/aapspec/spec"
  }
 ],
 "form": "endpoint",
 "governance": "No formal governance body; single individual author plus a GitHub organization (aapspec) hosting the spec text, reference implementation, schemas, and test vectors",
 "group": null,
 "history": [
  {
   "date": "2026-09-05",
   "note": "seeded from Exa Agent research run"
  },
  {
   "date": "2026-09-06",
   "note": "verified against datatracker.ietf.org/doc/draft-aap-oauth-profile/ and github.com/aapspec/spec; found expired"
  }
 ],
 "id": "aap",
 "implementation": "prototype",
 "last_verified": "2026-09-06",
 "name": "Agent Authorization Profile",
 "native_status": "Expired Internet-Draft (individual), per the IETF Datatracker; last updated 2026-08-11, latest revision -01 dated 2026-02-07",
 "origin": {
  "date": "2026-02-07",
  "org": "Individual author (\"angel cruz\"), published via IETF individual submission and the aapspec GitHub organization"
 },
 "part_of": null,
 "parties": [
  "agent-site"
 ],
 "phase": "withdrawn",
 "probe": {
  "method": "GET",
  "on_absent": "No AAP claims present; given the draft's expired status this is the expected default across the ecosystem",
  "parse": "Decode a returned access token as a JWT and check for AAP-specific claim names (agent identity, task binding, delegation chain) as documented in the aapspec/spec repository's JSON Schemas",
  "path": "{authorization_server}/.well-known/oauth-authorization-server"
 },
 "question": "How can OAuth 2.0/JWT claims carry structured agent identity, task context, operational constraints, delegation chains, and human-oversight requirements for machine-to-machine agent calls?",
 "scope": "general",
 "spec_url": "https://www.ietf.org/archive/id/draft-aap-oauth-profile-01.html",
 "step": "permit",
 "summary_md": "The Agent Authorization Profile (AAP) is a single-author IETF individual Internet-Draft, draft-aap-oauth-profile-01, dated 2026-02-07, proposing structured OAuth 2.0/JWT claims for autonomous AI agents [1]. It extends OAuth 2.0, JWT, RFC 8693 Token Exchange, and proof-of-possession mechanisms so that a resource server can reason about agent identity, task context, operational constraints, delegation chains, and whether human oversight is required for a given call, explicitly without introducing a new protocol [1].\n\nIt does not define a discovery mechanism beyond standard OAuth authorization-server metadata, and it does not define content-use or crawling permissions — like DAAP and AAuth, its scope is agent-to-API (M2M) authorization, not publisher content policy. Its distinguishing claim relative to those two overlapping drafts is a heavier emphasis on structured, machine-reasoned claims (delegation chains, human-oversight flags) rather than a minimal composition of existing mechanisms.\n\nAs of this verification (2026-09-06), the IETF Datatracker's own document-state field shows this draft as an 'Expired Internet-Draft (individual)', IESG state Expired, last updated 2026-08-11 with its single revision (-01) dated 2026-02-07 and no working-group affiliation — it never progressed beyond an individual submission [1]. The author's listed contact is separately flagged by the Datatracker as possibly no longer valid. A companion project exists at github.com/aapspec, including a spec repository (Apache 2.0 licensed), a claimed reference implementation, JSON Schemas, and test vectors, but the repository's own README shows an IETF-status checklist with no box beyond 'draft-00 submitted' checked, no GitHub stars, and no activity beyond the initial 2026-02-07 push found in this pass [2]. On that basis this record's phase is set to withdrawn and implementation to prototype (a reference implementation is claimed to exist, but with no evidence of independent use).\n\nWhat is unresolved: whether 'angel cruz' or another contributor intends to resubmit an active revision; whether any of AAP's specific claim names have been adopted informally by agent-framework builders outside the IETF process; and how AAP's more prescriptive claim-schema approach compares in practice to the lighter-weight DAAP profile, which explicitly avoids new claims. Given three overlapping, none-adopted individual OAuth-for-agents drafts (AAuth, DAAP, AAP) exist in this dataset, a future review should watch for which, if any, the OAuth Working Group formally adopts.",
 "track": "community",
 "version": {
  "date": "2026-02-07",
  "label": "draft-aap-oauth-profile-01"
 },
 "url": "https://agenticweb.wiki/protocols/aap/",
 "category": "permit",
 "type": "protocol"
}