agenticweb.wiki

OAuth Profile for Delegated AI Agent Authorization DAAP

Permit This record, seeded under the id daap and the name 'Delegated Agent Authorization Protocol', is the IETF individual Internet-Draft draft-mishra-oauth-agent-grants, whose own title is 'OAuth Profile for Delegated AI Agent Authorization' — the seed's acronym and description matched a real, verifiable draft, but the name carried by the seed record does not appear in the document text itself; 'Delegated Agent Authorization Protocol' and 'DAAP' are recorded here as aliases rather than the primary name, which has been corrected to the draft's actual title [1].

Overview

The draft addresses AI agents that invoke protected APIs on behalf of a human user. It defines an OAuth profile covering: identifying an agent client instance distinctly from the user's own client, obtaining the user's authenticated consent, issuing access tokens that are both resource-bound (audience-restricted) and sender-constrained (bound to the agent's key), attenuating an agent's authority through RFC 8693 OAuth Token Exchange, and rotating refresh tokens safely [1]. Its central design constraint, stated in its own abstract, is that it 'defines no new JWT claims or OAuth endpoints' — it is explicitly a profile of composition over existing IETF mechanisms (OAuth 2.0/2.1, Token Exchange, JOSE, DPoP-style sender constraints), not a new protocol.

It explicitly places operational concerns — policy engines, audit stores, spending budgets, event streams, credential vaults — outside its interoperable core, leaving those to implementers. It does not define content-use or crawling permissions; its scope is strictly delegated API-calling authority, positioning it as a 'permit' record specifically for the agent-site API-invocation case, adjacent to AAP and AAuth.

As of this verification (2026-09-06), the current version is -02, and the Datatracker's own document-state field shows it Active (not expired) with a last-updated date in the 2026-08 range, and an expiry of 3 March 2027 — confirming it is a live, in-progress draft rather than lapsed [1][2]. The draft names 'Grantex' as an incomplete reference implementation, explicitly stating conformance does not require it, so implementation is recorded as prototype rather than shipping [1].

What is unresolved: whether this draft will be adopted by the IETF OAuth Working Group as a formal work item (it is currently an individual submission), how it will be reconciled with the overlapping AAP and AAuth proposals covering similar agent-delegation ground within the same working group's orbit, and whether any production authorization server has implemented its specific attenuation/rotation profile beyond the Grantex reference code.

Discovery and probe

Standard OAuth 2.0 authorization/token endpoints; discovery via RFC 8414 Authorization Server Metadata (no new endpoints defined) · /.well-known/oauth-authorization-server

GET {authorization_server}/.well-known/oauth-authorization-server
parse:     Presence of Token Exchange (RFC 8693) grant support and sender-constraining (DPoP/mTLS) in the advertised grant_types_supported / token_endpoint_auth_methods_supported, as DAAP composes these existing mechanisms rather than adding new ones
on absent: Authorization server does not advertise the OAuth building blocks (Token Exchange, sender-constrained tokens) DAAP requires; this alone does not prove DAAP is unused, since DAAP defines no unique discoverable marker

Not probed live: no-fixed-path. DAAP rides on OAuth authorization server metadata; presence of that metadata does not prove the profile.

History

Instances

Every instance with its source is listed on the instances page.

See also

References

  1. draft-mishra-oauth-agent-grants-02 defines an OAuth profile for agent-client identification, user consent, resource-bound sender-constrained tokens, authority attenuation via RFC 8693 Token Exchange, and safe refresh-token rotation, using only existing OAuth/JOSE mechanisms and defining no new claims or endpoints. The draft names 'Grantex' as an incomplete, non-conformance-required reference implementation, distinguishing it from a production deployment. — https://datatracker.ietf.org/doc/html/draft-mishra-oauth-agent-grants-02 (2026-08) VERIFIED
  2. The IETF Datatracker's document page for draft-mishra-oauth-agent-grants confirms it as an Active Internet-Draft (individual submission) with no working-group affiliation shown, corroborating the draft text's own self-description. — https://datatracker.ietf.org/doc/draft-mishra-oauth-agent-grants/ (2026-08) REPORTED

JSON · Markdown