The proposal for the AAuth WG at the OpenID Foundation was accepted last Friday.
On Sun, Nov 1, 2026 at 3:19 PM Dick Hardt <[email protected]> wrote: > Jonathan, > > It is great that you and Pat are contributing more thinking towards the > challenges of agent auth. I’d like to point out a couple of things. > > Your §7 compares against draft-hardt-oauth-aauth-protocol (-11; it is now > at -12) but not draft-hardt-aauth-r3, which is where AAuth handles > resource-authored approval text. The resource writes the display content in > an R3 document, and the resource token carries its r3_uri and r3_s256. Only > the PS and AS can fetch the document. AAuth treats the agent as > adversarial, so the agent never sees the resource’s context. Per-call > proposals bind an approval to the call’s actual parameters, single use. > > Neither of us owns the name, but two different protocols called AAuth will > confuse people. There is an active community around AAuth at aauth.dev, > the AAuth Slack, and the AAuth Nights in SF, and an AAuth WG has been > proposed at the OpenID Foundation. > > /Dick > > On Sun, Nov 1, 2026 at 11:00 AM Jonathan Rosenberg <[email protected]> > wrote: > >> We had an OAuth interim meeting a few weeks back on the topic of AI agent >> authorization flows, discussing Dick's draft which is addressing that need. >> At the time, there was interest raised around solutions for this problem >> which can be done using an OAuth extension (namely, via a new grant flow), >> rather than a totally new protocol. >> >> In response to this interest, myself and Pat White revived our prior >> draft on this topic, filled out significant details, and we have just >> submitted: >> >> https://www.ietf.org/archive/id/draft-rosenberg-oauth-aauth-02.html >> >> There is a brief overview which I think gets the general idea across ( >> https://www.ietf.org/archive/id/draft-rosenberg-oauth-aauth-02.html#name-brief-overview-of-operation >> ) . This also has a section which compares this with Dick's document. >> >> I'll be in SF and am interested if there is community interest in >> pursuing a solution like this. >> >> Thx, >> Jonathan R. >> >> >> >> >> -- >> Jonathan Rosenberg, Ph.D. >> [email protected] >> http://www.jdrosen.net >> _______________________________________________ >> OAuth mailing list -- [email protected] >> To unsubscribe send an email to [email protected] >> >
_______________________________________________ OAuth mailing list -- [email protected] To unsubscribe send an email to [email protected]
