# AAuth Rich Resource Requests R3

[3 · Permit](/category/permit/)
Candidate · auto-drafted, unreviewed · confidence 60%

| AAuth Rich Resource Requests |
| --- |
| Category | [Permit](/category/permit/) |
| Part of | [Agent Authorization Grant](/protocols/aauth/) |
| Governed by | Individual IETF Internet-Draft submission, companion to the AAuth Protocol; no working group. |
| Status | Exploratory Draft (-00); no known implementations |
| Phase | draft |
| Implementation | none found |
| Adoption | unmeasured |
| Version | draft-hardt-aauth-r3-00 (2026-09-28) |
| Specification | [https://datatracker.ietf.org/doc/html/draft-hardt-aauth-r3-00](https://datatracker.ietf.org/doc/html/draft-hardt-aauth-r3-00) |
| Found at | Resource advertises supported operation vocabularies as r3_vocabularies; a resource token carries r3_uri and r3_s256 pointing at the R3 document |
| Last checked | 2026-10-18 |
| Freshness | current · checked 2026-10-18 |
| Solves | Let agents act on my website, Delegate a user's authority to an agent |

AAuth Rich Resource Requests (R3) is an agentic-web standard (endpoint) at step 3, Permit, governed by Individual IETF Internet-Draft submission, companion to the AAuth Protocol; its own status is "Exploratory Draft (-00); no known implementations" (draft). It answers: How can an agent request an API's named operations, and a person approve one exact call, without relying on opaque scope strings? Adoption is unmeasured, last verified 2026-10-18.

[Permit](/category/permit/) AAuth R3 is an individual IETF draft by Dick Hardt that extends AAuth so an agent can request named operations from a vocabulary the resource advertises, rather than scope strings. The resource describes the operations in a JSON R3 document identified by its SHA-256 hash, which the person's server shows for consent. The issuer places the granted operations and hash in the auth token, and the resource enforces from the token alone. For operations marked per-call, a single-use token is bound to the call's concrete parameters. The draft has no known implementations and defines no consent screen or revocation.

## Discovery and probe

Resource advertises supported operation vocabularies as r3_vocabularies; a resource token carries r3_uri and r3_s256 pointing at the R3 document

```
NONE
parse:
on absent:
```

Not probed live: no-fixed-path. candidate record; probe rule pending

## History
- 2026-10-16 — auto-drafted candidate from exa (https://insights.bostonidentity.com/research/ietf-datatracker-2026-09-28-aauth-rich-resource-requests)
- 2026-10-16 — spec_url moved from the Boston Identity write-up to the Internet-Draft draft-hardt-aauth-r3-00; ietf watch added
- 2026-10-16 — revision -00 → 00 (watcher)

## Instances

No instances recorded yet.

## See also

- Part of: [Agent Authorization Grant](/protocols/aauth/)

## References

- Individual-submission companion to the AAuth Protocol by Dick Hardt (Hellō); -00, marked Exploratory Draft, no known implementations. It replaces scope strings with resource-named operations in vocabularies (MCP, OpenAPI, gRPC, GraphQL, AsyncAPI, WSDL, OData), content-addressed R3 documents identified by SHA-256, and per-call proposals. — [https://insights.bostonidentity.com/research/ietf-datatracker-2026-09-28-aauth-rich-resource-requests](https://insights.bostonidentity.com/research/ietf-datatracker-2026-09-28-aauth-rich-resource-requests) (2026-09-28) REPORTED
- Datatracker shows draft-hardt-aauth-r3-00, dated 2026-09-28, expires 2027-04-01 — [https://datatracker.ietf.org/doc/draft-hardt-aauth-r3/](https://datatracker.ietf.org/doc/draft-hardt-aauth-r3/) (2026-09-28) VERIFIED

[JSON](/data/protocols/aauth-r3.json) · [Markdown](/protocols/aauth-r3/index.md)