agenticweb.wiki

Agent Authorization Grant AAuth

By Belgravia Labs Standards Observatory · Last verified · 5 primary sources

Agent Authorization Grant (AAuth) is an agentic-web standard (endpoint) at step 3, Permit, governed by IETF individual Internet-Draft; its status is "Expired Internet-Draft". It answers: "How can a conversational AI agent, reached over a channel without browser redirect (phone, SMS), obtain a properly scoped OAuth access token without impersonating the user?" Replacing or extending OAuth Device Authorization Grant, implementation status is none found, last verified 2026-10-23.

Permit The Agent Authorization Grant (AAuth) is an individual IETF Internet-Draft, draft-rosenberg-oauth-aauth-01 (dated 2026-04-22, succeeding -00 of 2025-10-19 and expired 2026-04-23), proposing an OAuth 2.1 extension for a specific class of AI agent: one reached through a channel that does not support browser-redirect OAuth flows, such as a phone call over the PSTN or SMS texting [1]. It solves a narrow but real permit-adjacent problem — authorization, not content-use permission — for voice/text-only conversational agents.

Overview

In the flow it describes, the agent collects personally identifying information from the user through natural-language conversation, then presents that collected PII to obtain an access token with an appropriately constrained scope, rather than redirecting the user to a login page it cannot render over a phone call. The draft's stated primary concern is architectural: ensuring that LLM hallucination inside the agent cannot itself cause an impersonation attack against the authorization flow [1].

It does not define a well-known discovery file, a permission vocabulary, or content-use semantics — it is purely an authorization-grant flow, adjacent to this wiki's 'identify' and 'permit' steps rather than a pure fit for either. It does not specify a concrete grant_type string or endpoint schema in enough detail in the sections reviewed to build an executable, generic probe; a probe would need to be implementation-specific.

The IETF Datatracker shows draft-rosenberg-oauth-aauth-01 (published 2026-04-22 after -00 of 2025-10-19) as an expired Internet-Draft (expired 2026-04-23), while active AAuth specification work in the OAuth ecosystem has continued in Dick Hardt's draft-hardt-oauth-aauth-protocol series (tracked under aauth-hardt). No independent implementation, reference server, or adopting product of Rosenberg's PSTN/SMS PII-collection grant was located, so implementation is recorded as none-found and this record's phase is set to withdrawn.

What is unresolved: whether the author (Jonathan Rosenberg) or another party intends to revive this line of work, and whether its PII-collection-then-token-exchange pattern will instead be absorbed into a more general draft such as DAAP or AAP, which address overlapping agent-authorization ground within the same OAuth ecosystem.

Discovery and probe

OAuth 2.1 extension grant flow; no well-known file defined

POST {authorization_server}/token with grant_type indicating the Agent Authorization Grant (exact grant_type string not fixed in the draft text reviewed)
parse:     A 200 response containing an access_token issued via the collected-PII flow described in the draft
on absent: Authorization server does not implement this grant; this is expected, since the draft is expired and no implementation was found

Not probed live: needs-credentials. The Agent Authorization Grant is observed only inside a token request.

Instances

No instances recorded yet.

See also

Comparisons

References

  1. draft-rosenberg-oauth-aauth defines an OAuth 2.1 extension letting an AI agent collect PII conversationally (over PSTN or texting, where redirect-based OAuth is unavailable) and exchange it for a scope-constrained access token, with an explicit goal of preventing LLM-hallucination-driven impersonation. — https://datatracker.ietf.org/doc/html/draft-rosenberg-oauth-aauth (2025-10-19) VERIFIED
  2. The raw draft-00 HTML text hosted at ietf.org/archive (distinct from the Datatracker's metadata/history page) confirms the same abstract, scope (PSTN/texting channels, PII-collection flow, anti-impersonation goal) and lets the Datatracker's 'Expired' state be cross-checked against the actual spec content rather than taken on the metadata page alone. — https://www.ietf.org/archive/id/draft-rosenberg-oauth-aauth-00.html (2025-10-19) VERIFIED
  3. draft-rosenberg-oauth-aauth-01 (2026-04-22) expired on 2026-04-23; the active AAuth lineage is draft-hardt-oauth-aauth-protocol-11 — https://datatracker.ietf.org/doc/draft-rosenberg-oauth-aauth/ (2026-04-23) VERIFIED
  4. draft-rosenberg-oauth-aauth-01 (2026-04-22) expired on 2026-04-23; the active AAuth lineage is draft-hardt-oauth-aauth-protocol-11 — https://datatracker.ietf.org/doc/draft-hardt-oauth-aauth-protocol/ (2026-04-23) VERIFIED
  5. Expired Internet-Draft (expired 2026-04-23) — https://datatracker.ietf.org/doc/draft-rosenberg-oauth-aauth/ (2025-10-20) VERIFIED

Disputed: The draft is expired per the IETF Datatracker's own document-state field, and no independent implementation was found; it is retained here as a documented proposal rather than an active spec.

Verification log and errata

JSON · Markdown · OKF v0.2

Frequently asked questions

What is Agent Authorization Grant (AAuth)?
Agent Authorization Grant (AAuth) is an agentic-web standard (endpoint) at step 3, Permit, governed by IETF individual Internet-Draft; its status is "Expired Internet-Draft". It answers: "How can a conversational AI agent, reached over a channel without browser redirect (phone, SMS), obtain a properly scoped OAuth access token without impersonating the user?" Replacing or extending OAuth Device Authorization Grant, implementation status is none found, last verified 2026-10-23.
What is the adoption and standardization status of Agent Authorization Grant?
Expired Internet-Draft (expired 2026-04-23), governed by IETF individual Internet-Draft (OAuth-adjacent, not yet adopted by the OAuth Working Group as of this verification). Implementation: none found. Version: draft-rosenberg-oauth-aauth-01 (2026-04-22). Last verified 2026-10-23.
How does Agent Authorization Grant compare to other permit protocols?
Agent Authorization Grant (AAuth) is one of 32 standards at step 3, Permit (What may the agent do here?). It pairs with OAuth Profile for Delegated AI Agent Authorization, Agent Authorization Profile, AI Agent Authentication and Authorization, OAuth Protected Resource and Authorization Server Metadata (as used for agent authorization). Head-to-head comparisons on this site: OAuth 2.0 Consent & DCR vs CIMD & Agent OAuth Metadata, Identity Assertion JWT Authorization Grant (ID-JAG), AAuth (Hardt). Every standard at this step is listed at https://agenticweb.wiki/category/permit/.