# Attenuated Delegation Profile for Automated Agents

[3 · Permit](/category/permit/)

| Attenuated Delegation Profile for Automated Agents |
| --- |
| Category | [Permit](/category/permit/) |
| Governed by | IETF OAuth Working Group (Web Authorization Protocol). Standards Track working-group draft. |
| Status | Active Internet-Draft, OAuth WG document, Intended status: Standards Track; draft-hamr-oauth-agent-delegation-02 dated 2026-09-19, expires 2027-03-23 |
| Phase | working group |
| Implementation | none found |
| Adoption | unmeasured |
| Version | draft-hamr-oauth-agent-delegation-02 (2026-09-19) |
| Specification | [https://www.ietf.org/archive/id/draft-hamr-oauth-agent-delegation-02.txt](https://www.ietf.org/archive/id/draft-hamr-oauth-agent-delegation-02.txt) |
| Found at | An Agent-Delegation HTTP header on a request signed with RFC 9421. No well-known file is defined. |
| Acronym collisions | Agent Authorization Profile (draft-aap-oauth-profile) and OpenA2A AAP, which are token models rather than this header |
| Last checked | 2026-10-20 |
| Freshness | current · checked 2026-10-20 |
| Solves | Delegate a user's authority to an agent, Audit what an agent did, Prove an agent's identity |

Attenuated Delegation Profile for Automated Agents is an agentic-web standard (HTTP header) at step 3, Permit, governed by IETF OAuth Working Group (Web Authorization Protocol). Standards Track working-group draft; its own status is "Active Internet-Draft, OAuth WG document, Intended status: Standards Track; draft-hamr-oauth-agent-delegation-02 dated 2026-09-19, expires 2027-03-23" (working group). It answers: How can an automated agent pass on a user's authority so that each hop can only narrow scope, floors, and expiry? Adoption is unmeasured, last verified 2026-10-20.

[Permit](/category/permit/) draft-hamr-oauth-agent-delegation-02 is a Standards Track Internet-Draft of the IETF OAuth working group, dated 19 September 2026 and expiring 23 March 2027 [[1]](#ref-1). It defines an Agent-Delegation HTTP header on top of RFC 9421 HTTP Message Signatures [[1]](#ref-1). Each link in the chain can only narrow scope, floors, and expiry. Call classes are r, w, and x [[1]](#ref-1).

## Overview
It is a separate record from the Workload Authorization Grant, the identity-continuation assertion, and both AAP documents. The datatracker entry for the draft is [[2]](#ref-2).

## Discovery and probe

An Agent-Delegation HTTP header on a request signed with RFC 9421. No well-known file is defined.

```
n/a n/a (Agent-Delegation request header; no fixed origin artifact)
parse:     n/a. Look for an Agent-Delegation header on a request signed under RFC 9421. Call classes are r, w, and x. Each link can only narrow scope, floors, and expiry.
on absent: No Agent-Delegation header on a given request means this profile was not used for that call.
```

Not probed live: no-fixed-path. Agent-Delegation is an HTTP header on a request signed with RFC 9421; there is no fixed path to fetch.

## History
- 2026-10-20 — added from staged research 2026-10-20; header read from draft-hamr-oauth-agent-delegation-02

## Instances

No instances recorded yet.

## See also

- Not to be confused with: Agent Authorization Profile (draft-aap-oauth-profile) and OpenA2A AAP, which are token models rather than this header

## References

- draft-hamr-oauth-agent-delegation-02 is a Standards Track Internet-Draft of the Web Authorization Protocol (OAuth) working group, dated 19 September 2026 and expiring 23 March 2027. It defines an Agent-Delegation HTTP header on top of RFC 9421. Each link can only narrow scope, floors, and expiry. Call classes are r, w, and x. — [https://www.ietf.org/archive/id/draft-hamr-oauth-agent-delegation-02.txt](https://www.ietf.org/archive/id/draft-hamr-oauth-agent-delegation-02.txt) (2026-09-19) VERIFIED
- Datatracker document page for draft-hamr-oauth-agent-delegation. — [https://datatracker.ietf.org/doc/draft-hamr-oauth-agent-delegation/](https://datatracker.ietf.org/doc/draft-hamr-oauth-agent-delegation/) (2026-09-19) VERIFIED

[JSON](/data/protocols/oauth-agent-delegation.json) · [Markdown](/protocols/oauth-agent-delegation/index.md)