agenticweb.wiki

OAuth Profile for Delegated AI Agent Authorization DAAP · /.well-known/oauth-authorization-server

By Belgravia Labs Standards Observatory · Last verified · 3 primary sources

OAuth Profile for Delegated AI Agent Authorization (DAAP) is an agentic-web standard (endpoint — /.well-known/oauth-authorization-server) at step 3, Permit, governed by IETF individual Internet-Draft; its status is "Internet-Draft, individual submission, Active". It answers: "How can a human user delegate constrained, attenuable, revocable authority to an AI agent using standard OAuth mechanisms, with no new endpoints or claims required?" Replacing or extending OAuth delegated grant / consent screen, implementation status is prototype, last verified 2026-10-29.

Permit OAuth Profile for Delegated AI Agent Authorization (draft-mishra-oauth-agent-grants, also referenced externally as DAAP or Delegated Agent Authorization Protocol) is an IETF individual Internet-Draft [1].

Overview

The draft addresses AI agents that invoke protected APIs on behalf of a human user. It defines an OAuth profile covering: identifying an agent client instance distinctly from the user's own client, obtaining the user's authenticated consent, issuing access tokens that are both resource-bound (audience-restricted) and sender-constrained (bound to the agent's key), attenuating an agent's authority through RFC 8693 OAuth Token Exchange, and rotating refresh tokens safely [1]. Its central design constraint, stated in its own abstract, is that it 'defines no new JWT claims or OAuth endpoints' — it is explicitly a profile of composition over existing IETF mechanisms (OAuth 2.0/2.1, Token Exchange, JOSE, DPoP-style sender constraints), not a new protocol.

It explicitly places operational concerns — policy engines, audit stores, spending budgets, event streams, credential vaults — outside its interoperable core, leaving those to implementers. It does not define content-use or crawling permissions; its scope is strictly delegated API-calling authority, positioning it as a 'permit' record specifically for the agent-site API-invocation case, adjacent to AAP and AAuth.

As of this verification (2026-09-06), the current version is -02, and the Datatracker's own document-state field shows it Active (not expired) with a last-updated date in the 2026-08 range, and an expiry of 3 March 2027 — confirming it is a live, in-progress draft rather than lapsed [1][2]. The draft names 'Grantex' as an incomplete reference implementation, explicitly stating conformance does not require it, so implementation is recorded as prototype rather than shipping [1].

What is unresolved: whether this draft will be adopted by the IETF OAuth Working Group as a formal work item (it is currently an individual submission), how it will be reconciled with the overlapping AAP and AAuth proposals covering similar agent-delegation ground within the same working group's orbit, and whether any production authorization server has implemented its specific attenuation/rotation profile beyond the Grantex reference code.

Discovery and probe

Standard OAuth 2.0 authorization/token endpoints; discovery via RFC 8414 Authorization Server Metadata (no new endpoints defined) · /.well-known/oauth-authorization-server

GET {authorization_server}/.well-known/oauth-authorization-server
parse:     Presence of Token Exchange (RFC 8693) grant support and sender-constraining (DPoP/mTLS) in the advertised grant_types_supported / token_endpoint_auth_methods_supported, as DAAP composes these existing mechanisms rather than adding new ones
on absent: Authorization server does not advertise the OAuth building blocks (Token Exchange, sender-constrained tokens) DAAP requires; this alone does not prove DAAP is unused, since DAAP defines no unique discoverable marker

Not probed live: no-fixed-path. DAAP rides on OAuth authorization server metadata; presence of that metadata does not prove the profile.

Instances

Every instance with its source is listed on the instances page.

See also

Comparisons

References

  1. draft-mishra-oauth-agent-grants-02 defines an OAuth profile for agent-client identification, user consent, resource-bound sender-constrained tokens, authority attenuation via RFC 8693 Token Exchange, and safe refresh-token rotation, using only existing OAuth/JOSE mechanisms and defining no new claims or endpoints. The draft names 'Grantex' as an incomplete, non-conformance-required reference implementation, distinguishing it from a production deployment. — https://datatracker.ietf.org/doc/html/draft-mishra-oauth-agent-grants-02 (2026-08) VERIFIED
  2. The IETF Datatracker's document page for draft-mishra-oauth-agent-grants confirms it as an Active Internet-Draft (individual submission) with no working-group affiliation shown, corroborating the draft text's own self-description. — https://datatracker.ietf.org/doc/draft-mishra-oauth-agent-grants/ (2026-08) REPORTED
  3. draft-mishra-oauth-agent-grants-02 is dated 2026-08-30 — https://datatracker.ietf.org/doc/draft-mishra-oauth-agent-grants/ (2026-08-30) VERIFIED

Verification log and errata

JSON · Markdown · OKF v0.2

Frequently asked questions

What is OAuth Profile for Delegated AI Agent Authorization (DAAP)?
OAuth Profile for Delegated AI Agent Authorization (DAAP) is an agentic-web standard (endpoint — /.well-known/oauth-authorization-server) at step 3, Permit, governed by IETF individual Internet-Draft; its status is "Internet-Draft, individual submission, Active". It answers: "How can a human user delegate constrained, attenuable, revocable authority to an AI agent using standard OAuth mechanisms, with no new endpoints or claims required?" Replacing or extending OAuth delegated grant / consent screen, implementation status is prototype, last verified 2026-10-29.
What is the adoption and standardization status of OAuth Profile for Delegated AI Agent Authorization?
Internet-Draft, individual submission, Active, governed by IETF individual Internet-Draft (OAuth-adjacent; not yet adopted by the OAuth Working Group as of this verification). Implementation: prototype. Version: draft-mishra-oauth-agent-grants-02 (2026-08-30). Last verified 2026-10-29.
How does OAuth Profile for Delegated AI Agent Authorization compare to other permit protocols?
OAuth Profile for Delegated AI Agent Authorization (DAAP) is one of 32 standards at step 3, Permit (What may the agent do here?). It pairs with Agent Authorization Profile, Agent Authorization Grant, HTTP Message Signatures, OAuth Protected Resource and Authorization Server Metadata (as used for agent authorization). It builds on OAuth Protected Resource and Authorization Server Metadata (as used for agent authorization). Head-to-head comparisons on this site: OAuth 2.0 Consent & DCR vs CIMD & Agent OAuth Metadata, Agent Authorization Grant, Identity Assertion JWT Authorization Grant (ID-JAG). Every standard at this step is listed at https://agenticweb.wiki/category/permit/.