Jonathan, It is great that you and Pat are contributing more thinking towards the challenges of agent auth. I’d like to point out a couple of things.
Your §7 compares against draft-hardt-oauth-aauth-protocol (-11; it is now at -12) but not draft-hardt-aauth-r3, which is where AAuth handles resource-authored approval text. The resource writes the display content in an R3 document, and the resource token carries its r3_uri and r3_s256. Only the PS and AS can fetch the document. AAuth treats the agent as adversarial, so the agent never sees the resource’s context. Per-call proposals bind an approval to the call’s actual parameters, single use. Neither of us owns the name, but two different protocols called AAuth will confuse people. There is an active community around AAuth at aauth.dev, the AAuth Slack, and the AAuth Nights in SF, and an AAuth WG has been proposed at the OpenID Foundation. /Dick On Sun, Nov 1, 2026 at 11:00 AM Jonathan Rosenberg <[email protected]> wrote: > We had an OAuth interim meeting a few weeks back on the topic of AI agent > authorization flows, discussing Dick's draft which is addressing that need. > At the time, there was interest raised around solutions for this problem > which can be done using an OAuth extension (namely, via a new grant flow), > rather than a totally new protocol. > > In response to this interest, myself and Pat White revived our prior draft > on this topic, filled out significant details, and we have just submitted: > > https://www.ietf.org/archive/id/draft-rosenberg-oauth-aauth-02.html > > There is a brief overview which I think gets the general idea across ( > https://www.ietf.org/archive/id/draft-rosenberg-oauth-aauth-02.html#name-brief-overview-of-operation > ) . This also has a section which compares this with Dick's document. > > I'll be in SF and am interested if there is community interest in pursuing > a solution like this. > > Thx, > Jonathan R. > > > > > -- > Jonathan Rosenberg, Ph.D. > [email protected] > http://www.jdrosen.net > _______________________________________________ > OAuth mailing list -- [email protected] > To unsubscribe send an email to [email protected] >
_______________________________________________ OAuth mailing list -- [email protected] To unsubscribe send an email to [email protected]
