What is the adoption and standardization status of AAuth (Hardt)?

Active Internet-Draft, draft-hardt-oauth-aauth-protocol-11 (2026-09-25, expires 2027-03-29); the companion draft-hardt-aauth-headers-00 (2026-10-04) is marked Expired by the Datatracker — phase draft, governed by IETF Internet-Draft by Dick Hardt. Adoption: unmeasured. Version: draft-hardt-oauth-aauth-protocol-11 (2026-09-25). Last verified 2026-10-18.

How does AAuth (Hardt) compare to other permit protocols?

AAuth (Hardt) is one of 22 standards at step 3, Permit (What may the agent do here?). It pairs with HTTP Message Signatures, Agent Authorization Grant, Signature Agent Card (Web Bot Auth registry), OAuth Protected Resource and Authorization Server Metadata (as used for agent authorization). It builds on HTTP Message Signatures. Every standard at this step is listed at https://agenticweb.wiki/category/permit/.

AAuth (Hardt) AAuth

3 · Permit

AAuth (Hardt)
Category	Permit
Governed by	IETF Internet-Draft by Dick Hardt
Status	Active Internet-Draft, draft-hardt-oauth-aauth-protocol-11 (2026-09-25, expires 2027-03-29); the companion draft-hardt-aauth-headers-00 (2026-10-04) is marked Expired by the Datatracker
Phase	draft
Implementation	unknown
Adoption	unmeasured
Version	draft-hardt-oauth-aauth-protocol-11 (2026-09-25)
Specification	https://datatracker.ietf.org/doc/draft-hardt-oauth-aauth-protocol/
Found at	not determined from the datatracker listing
Acronym collisions	Agent Authorization Grant (Rosenberg), draft-rosenberg-oauth-aauth
Last checked	2026-10-18
Freshness	current · checked 2026-10-18
Solves	Prove an agent's identity, Delegate a user's authority to an agent

AAuth (Hardt) is an agentic-web standard (HTTP header) at step 3, Permit, governed by IETF Internet-Draft by Dick Hardt; its own status is "Active Internet-Draft, draft-hardt-oauth-aauth-protocol-11 (2026-09-25, expires 2027-03-29); the companion draft-hardt-aauth-headers-00 (2026-10-04) is marked Expired by the Datatracker" (draft). It answers: How does an agent obtain and present authorisation to act at a resource, using signed HTTP requests? Adoption is unmeasured, last verified 2026-10-18.

Permit AAuth in its current form is Dick Hardt's Internet-Draft draft-hardt-oauth-aauth-protocol, at revision -11 (2026-09-25, expiring 2027-03-29) ^[1]. A companion draft, draft-hardt-aauth-headers, was published as -00 on 2026-10-04 and is already marked Expired by the Datatracker ^[2]; the protocol draft itself is active.

Overview

This is a different document from the Rosenberg draft, which this site tracks as aauth (Agent Authorization Grant). That one expired on 2026-04-23, and the Hardt draft is the active AAuth line.

The form, party and discovery details here are placeholders pending a read of the drafts; only the version, dates and expiry above are taken from the datatracker.

Discovery and probe

not determined from the datatracker listing

GET none
parse:     not applicable: discovery mechanics were not reviewed for this record
on absent: No presence signal exists for this record; absence of a probe result says nothing about adoption.

Not probed live: no-fixed-path. candidate record; probe rule pending

History

2026-10-15 — curated update 2026-10-15
2026-10-16 — Expired Internet-Draft (expired 2026-10-04)
2026-10-16 — correction: the 2026-10-04 expiry belongs to the companion headers draft; the protocol draft -11 is active until 2027-03-29, so native_status and phase restored
2026-10-16 — use-case tags (auto)
2026-10-16 — Companion draft draft-hardt-aauth-headers-00 expired on 2026-10-04; the record follows draft-hardt-oauth-aauth-protocol

Instances

No instances recorded yet.

References

draft-hardt-oauth-aauth-protocol-11 is dated 2026-09-25 and expires 2027-03-29. — https://datatracker.ietf.org/doc/draft-hardt-oauth-aauth-protocol/ (2026-09-25) VERIFIED
draft-hardt-aauth-headers-00 is dated 2026-10-04. — https://datatracker.ietf.org/doc/draft-hardt-aauth-headers/ (2026-10-04) VERIFIED
draft-hardt-aauth-headers-00 (the companion headers draft, not the protocol draft) is marked Expired by the Datatracker as of 2026-10-04. — https://datatracker.ietf.org/doc/draft-hardt-aauth-headers/ (2026-04-02) VERIFIED
Companion draft draft-hardt-aauth-headers-00 expired on 2026-10-04; the record follows draft-hardt-oauth-aauth-protocol — https://datatracker.ietf.org/doc/draft-hardt-aauth-headers/ (2026-04-02) VERIFIED

JSON · Markdown