What is the adoption and standardization status of AAuth Rich Resource Requests?

Exploratory Draft (-00); no known implementations — phase draft, governed by Individual IETF Internet-Draft submission, companion to the AAuth Protocol; no working group.. Adoption: unmeasured. Version: draft-hardt-aauth-r3-00 (2026-09-28). Last verified 2026-10-18.

How does AAuth Rich Resource Requests compare to other permit protocols?

AAuth Rich Resource Requests (R3) is one of 22 standards at step 3, Permit (What may the agent do here?). It pairs with Agent Authorization Grant, AAuth (Hardt), Model Context Protocol. It builds on Agent Authorization Grant. Every standard at this step is listed at https://agenticweb.wiki/category/permit/.

AAuth Rich Resource Requests R3

3 · Permit

Candidate · auto-drafted, unreviewed · confidence 60%

AAuth Rich Resource Requests
Category	Permit
Part of	Agent Authorization Grant
Governed by	Individual IETF Internet-Draft submission, companion to the AAuth Protocol; no working group.
Status	Exploratory Draft (-00); no known implementations
Phase	draft
Implementation	none found
Adoption	unmeasured
Version	draft-hardt-aauth-r3-00 (2026-09-28)
Specification	https://datatracker.ietf.org/doc/html/draft-hardt-aauth-r3-00
Found at	Resource advertises supported operation vocabularies as r3_vocabularies; a resource token carries r3_uri and r3_s256 pointing at the R3 document
Last checked	2026-10-18
Freshness	current · checked 2026-10-18
Solves	Let agents act on my website, Delegate a user's authority to an agent

AAuth Rich Resource Requests (R3) is an agentic-web standard (endpoint) at step 3, Permit, governed by Individual IETF Internet-Draft submission, companion to the AAuth Protocol; its own status is "Exploratory Draft (-00); no known implementations" (draft). It answers: How can an agent request an API's named operations, and a person approve one exact call, without relying on opaque scope strings? Adoption is unmeasured, last verified 2026-10-18.

Permit AAuth R3 is an individual IETF draft by Dick Hardt that extends AAuth so an agent can request named operations from a vocabulary the resource advertises, rather than scope strings. The resource describes the operations in a JSON R3 document identified by its SHA-256 hash, which the person's server shows for consent. The issuer places the granted operations and hash in the auth token, and the resource enforces from the token alone. For operations marked per-call, a single-use token is bound to the call's concrete parameters. The draft has no known implementations and defines no consent screen or revocation.

Discovery and probe

Resource advertises supported operation vocabularies as r3_vocabularies; a resource token carries r3_uri and r3_s256 pointing at the R3 document

NONE 
parse:     
on absent:

Not probed live: no-fixed-path. candidate record; probe rule pending

History

2026-10-16 — auto-drafted candidate from exa (https://insights.bostonidentity.com/research/ietf-datatracker-2026-09-28-aauth-rich-resource-requests)
2026-10-16 — spec_url moved from the Boston Identity write-up to the Internet-Draft draft-hardt-aauth-r3-00; ietf watch added
2026-10-16 — revision -00 → 00 (watcher)

Instances

No instances recorded yet.

References

Individual-submission companion to the AAuth Protocol by Dick Hardt (Hellō); -00, marked Exploratory Draft, no known implementations. It replaces scope strings with resource-named operations in vocabularies (MCP, OpenAPI, gRPC, GraphQL, AsyncAPI, WSDL, OData), content-addressed R3 documents identified by SHA-256, and per-call proposals. — https://insights.bostonidentity.com/research/ietf-datatracker-2026-09-28-aauth-rich-resource-requests (2026-09-28) REPORTED
Datatracker shows draft-hardt-aauth-r3-00, dated 2026-09-28, expires 2027-04-01 — https://datatracker.ietf.org/doc/draft-hardt-aauth-r3/ (2026-09-28) VERIFIED

JSON · Markdown