Agent Operation Authorization#

Dapeng Liu, Suresh Krishnan

• Why: The sharpest articulation of OAuth's agent gap: OAuth grants broad permissions (scope=write), but prompt injection can steer an agent into malicious actions that are within the granted permission — permission ≠ behavior — and OAuth proves who the user is, not "agent X acting for user Y on task Z." This draft proposes binding behavioral policy plus delegation plus user-intent evidence into the access token.
• What: The Agent Operation Authorization (AOA) framework: a structured, machine-readable agent_operation_proposal (a JWT, deliberately excluding the user's natural-language input), validated by the AS into an Agent Operation Authorization Token that cryptographically binds user + agent instance + operation policy constraints (e.g., amount ≤ 50, time == "Nov 11 night"), enforceable at runtime by agents and verifiers — resisting both prompt injection and hallucinated parsing of intent.
• How: Tripartite binding via AS-signed evidence; trust model treats the LLM as untrusted, the agent runtime as trusted (signs requests), the AS as sole witness. Ecosystem fit: PAR, JWT, standard error codes; WIMSE workload identity for agent authentication; OPA/Rego for policy enforcement. Open-source implementation: Open Agent Auth (Alibaba), demoed at the IETF 125 hackathon.
• Where applicable: Any autonomous-agent platform calling protected APIs. Early individual draft — the authors are explicitly seeking WG consensus on the problem and on the shift from scope-based to policy-based authorization. Whether or not this exact design wins, the problem statement is the one to align products against.