# Agent Authorization Grant AAuth

[3 · Permit](/category/permit/)

| Agent Authorization Grant |
| --- |
| Category | [Permit](/category/permit/) |
| Governed by | IETF individual Internet-Draft (OAuth-adjacent, not yet adopted by the OAuth Working Group as of this verification) |
| Status | Internet-Draft, individual submission; page marked "Expired" by the IETF Datatracker |
| Phase | withdrawn |
| Implementation | none found |
| Adoption | unmeasured |
| Version | draft-rosenberg-oauth-aauth-00 (2025-10-19) |
| Specification | [https://datatracker.ietf.org/doc/html/draft-rosenberg-oauth-aauth](https://datatracker.ietf.org/doc/html/draft-rosenberg-oauth-aauth) |
| Found at | OAuth 2.1 extension grant flow; no well-known file defined |
| Last checked | 2026-09-06 |

[Permit](/category/permit/) The Agent Authorization Grant (AAuth) is an individual IETF Internet-Draft, draft-rosenberg-oauth-aauth-00, dated 2025-10-19, proposing an OAuth 2.1 extension for a specific class of AI agent: one reached through a channel that does not support browser-redirect OAuth flows, such as a phone call over the PSTN or SMS texting [[1]](#ref-1). It solves a narrow but real permit-adjacent problem — authorization, not content-use permission — for voice/text-only conversational agents.

## Overview
In the flow it describes, the agent collects personally identifying information from the user through natural-language conversation, then presents that collected PII to obtain an access token with an appropriately constrained scope, rather than redirecting the user to a login page it cannot render over a phone call. The draft's stated primary concern is architectural: ensuring that LLM hallucination inside the agent cannot itself cause an impersonation attack against the authorization flow [[1]](#ref-1).

It does not define a well-known discovery file, a permission vocabulary, or content-use semantics — it is purely an authorization-grant flow, adjacent to this wiki's 'identify' and 'permit' steps rather than a pure fit for either. It does not specify a concrete grant_type string or endpoint schema in enough detail in the sections reviewed to build an executable, generic probe; a probe would need to be implementation-specific.

As of this verification (2026-09-06), the IETF Datatracker page for this draft shows its document state as an expired Internet-Draft; IETF drafts lapse automatically after roughly six months without a new revision, and no successor version beyond -00 was found. No independent implementation, reference server, or adopting product was located during this pass, so implementation is recorded as none-found rather than prototype. Given the expired status and absence of any implementation or successor draft, this record's phase is set to withdrawn: the proposal exists as a documented idea but has not advanced and appears inactive.

What is unresolved: whether the author (Jonathan Rosenberg) or another party intends to revive this line of work, and whether its PII-collection-then-token-exchange pattern will instead be absorbed into a more general draft such as DAAP or AAP, which address overlapping agent-authorization ground within the same OAuth ecosystem.

## Discovery and probe

OAuth 2.1 extension grant flow; no well-known file defined

```
POST {authorization_server}/token with grant_type indicating the Agent Authorization Grant (exact grant_type string not fixed in the draft text reviewed)
parse:     A 200 response containing an access_token issued via the collected-PII flow described in the draft
on absent: Authorization server does not implement this grant; this is expected, since the draft is expired and no implementation was found
```

Not probed live: needs-credentials. The Agent Authorization Grant is observed only inside a token request.

## History
- 2026-09-05 — seeded from Exa Agent research run
- 2026-09-06 — verified against datatracker.ietf.org/doc/html/draft-rosenberg-oauth-aauth; found expired

## Instances

- [Aembit](https://aembit.io/blog/how-aauth-brings-human-approval-into-ai-agent-authorization/) · Observed 2026-08-14 · business
- [marcofanti / aauth-java-library](https://github.laiyagushi.com/marcofanti/aauth-java-library) · Observed 2026-07-30 · service
- [christian-posta / aauth-go-library](https://github.laiyagushi.com/christian-posta/aauth-go-library) · Observed 2026-05-11 · service
- [AAuth for MCP (packages-js)](https://github.com/clawdreyhepburn/packages-js) · Observed 2026-05-01 · service
- [mcp-shark/aauth-explorer](https://github.com/mcp-shark/aauth-explorer) · Observed 2026-04-23 · site

Every instance with its source is listed on the [instances page](/instances/).

## See also

## References

- draft-rosenberg-oauth-aauth defines an OAuth 2.1 extension letting an AI agent collect PII conversationally (over PSTN or texting, where redirect-based OAuth is unavailable) and exchange it for a scope-constrained access token, with an explicit goal of preventing LLM-hallucination-driven impersonation. — [https://datatracker.ietf.org/doc/html/draft-rosenberg-oauth-aauth](https://datatracker.ietf.org/doc/html/draft-rosenberg-oauth-aauth) (2025-10-19) VERIFIED
- The raw draft-00 HTML text hosted at ietf.org/archive (distinct from the Datatracker's metadata/history page) confirms the same abstract, scope (PSTN/texting channels, PII-collection flow, anti-impersonation goal) and lets the Datatracker's 'Expired' state be cross-checked against the actual spec content rather than taken on the metadata page alone. — [https://www.ietf.org/archive/id/draft-rosenberg-oauth-aauth-00.html](https://www.ietf.org/archive/id/draft-rosenberg-oauth-aauth-00.html) (2025-10-19) VERIFIED

Disputed: The draft is expired per the IETF Datatracker's own document-state field, and no independent implementation was found; it is retained here as a documented proposal rather than an active spec.

[JSON](/data/protocols/aauth.json) · [Markdown](/protocols/aauth/index.md)