What is the adoption and standardization status of Attenuated Delegation Profile for Automated Agents?

Active Internet-Draft, OAuth WG document, Intended status: Standards Track; draft-hamr-oauth-agent-delegation-02 dated 2026-09-19, expires 2027-03-23 — phase working group, governed by IETF OAuth Working Group (Web Authorization Protocol). Standards Track working-group draft.. Adoption: unmeasured. Version: draft-hamr-oauth-agent-delegation-02 (2026-09-19). Last verified 2026-10-20.

How does Attenuated Delegation Profile for Automated Agents compare to other permit protocols?

Attenuated Delegation Profile for Automated Agents is one of 32 standards at step 3, Permit (What may the agent do here?). It pairs with HTTP Message Signatures, Identity Assertion JWT Authorization Grant, Workload Authorization Grant, Identity Continuation Assertion for OAuth 2.0 Token Exchange. It builds on HTTP Message Signatures. Every standard at this step is listed at https://agenticweb.wiki/category/permit/.

Attenuated Delegation Profile for Automated Agents

3 · Permit

Attenuated Delegation Profile for Automated Agents
Category	Permit
Governed by	IETF OAuth Working Group (Web Authorization Protocol). Standards Track working-group draft.
Status	Active Internet-Draft, OAuth WG document, Intended status: Standards Track; draft-hamr-oauth-agent-delegation-02 dated 2026-09-19, expires 2027-03-23
Phase	working group
Implementation	none found
Adoption	unmeasured
Version	draft-hamr-oauth-agent-delegation-02 (2026-09-19)
Specification	https://www.ietf.org/archive/id/draft-hamr-oauth-agent-delegation-02.txt
Found at	An Agent-Delegation HTTP header on a request signed with RFC 9421. No well-known file is defined.
Acronym collisions	Agent Authorization Profile (draft-aap-oauth-profile) and OpenA2A AAP, which are token models rather than this header
Last checked	2026-10-20
Freshness	current · checked 2026-10-20
Solves	Delegate a user's authority to an agent, Audit what an agent did, Prove an agent's identity

Attenuated Delegation Profile for Automated Agents is an agentic-web standard (HTTP header) at step 3, Permit, governed by IETF OAuth Working Group (Web Authorization Protocol). Standards Track working-group draft; its own status is "Active Internet-Draft, OAuth WG document, Intended status: Standards Track; draft-hamr-oauth-agent-delegation-02 dated 2026-09-19, expires 2027-03-23" (working group). It answers: How can an automated agent pass on a user's authority so that each hop can only narrow scope, floors, and expiry? Adoption is unmeasured, last verified 2026-10-20.

Permit draft-hamr-oauth-agent-delegation-02 is a Standards Track Internet-Draft of the IETF OAuth working group, dated 19 September 2026 and expiring 23 March 2027 ^[1]. It defines an Agent-Delegation HTTP header on top of RFC 9421 HTTP Message Signatures ^[1]. Each link in the chain can only narrow scope, floors, and expiry. Call classes are r, w, and x ^[1].

Overview

It is a separate record from the Workload Authorization Grant, the identity-continuation assertion, and both AAP documents. The datatracker entry for the draft is ^[2].

Discovery and probe

An Agent-Delegation HTTP header on a request signed with RFC 9421. No well-known file is defined.

n/a n/a (Agent-Delegation request header; no fixed origin artifact)
parse:     n/a. Look for an Agent-Delegation header on a request signed under RFC 9421. Call classes are r, w, and x. Each link can only narrow scope, floors, and expiry.
on absent: No Agent-Delegation header on a given request means this profile was not used for that call.

Not probed live: no-fixed-path. Agent-Delegation is an HTTP header on a request signed with RFC 9421; there is no fixed path to fetch.

History

2026-10-20 — added from staged research 2026-10-20; header read from draft-hamr-oauth-agent-delegation-02

Instances

No instances recorded yet.

References

draft-hamr-oauth-agent-delegation-02 is a Standards Track Internet-Draft of the Web Authorization Protocol (OAuth) working group, dated 19 September 2026 and expiring 23 March 2027. It defines an Agent-Delegation HTTP header on top of RFC 9421. Each link can only narrow scope, floors, and expiry. Call classes are r, w, and x. — https://www.ietf.org/archive/id/draft-hamr-oauth-agent-delegation-02.txt (2026-09-19) VERIFIED
Datatracker document page for draft-hamr-oauth-agent-delegation. — https://datatracker.ietf.org/doc/draft-hamr-oauth-agent-delegation/ (2026-09-19) VERIFIED

JSON · Markdown