Draft-02 of the Agent Authorization Envelope is at the IETF as of this week. Short version of what it is and why it might matter to you if you run agents.
The gap: OAuth, API keys, ACLs authorize a caller at a door. An autonomous agent needs something different — a statement of what it's mandated to do, bounded, time- limited, and checkable by a third party who doesn't trust whoever enforced it.
What -02 specifies:
A mandate as signed grants. Each grant binds one action type by a digest over a domain-tagged, JCS-canonicalized form, plus constraints (exact / enum / range) that bound the concrete instance. Matching is deterministic — no interpretation.
verdict = PERMIT | DENY | PENDING
A verdict that's a pure function of (mandate, transaction). No server state, no clock, no DB. Two verifiers get byte-identical results. That's the whole point: you recompute the decision instead of trusting a dashboard. The reference kernel and the published conformance vectors reproduce each other, vectors pinned to a kernel version so you can rebuild and diff.
Delegation that only narrows: a child's grants must be a subset of the parent's, numeric bounds tighter, disposition monotone (allow ≤ hold ≤ forbid, never the other way). Chain walk re-verifies every ancestor signature, detects cycles, takes minimum validity.
Honest about state: the chain walk is module-verified, not yet full-HTTP-E2E; and URI ancestor retrieval, did:web subjects, and the RP side of cascade revocation are deferred to a future revision — all on the same missing piece, a safe egress path. The draft says so plainly.
pip install moltrust-enforce
Endpoints live, vectors public. If you're running agents and the question "was this action actually authorized, and can I prove it to someone who doesn't trust me" is one you have — this is what it's build for.
Draft: datatracker.ietf.org/doc/draft-kroehl-agentic-trust-aae/
Lars
Posted on
AAE draft-02 at the IETF: authorization autonomous agents can't talk their way past
For further actions, you may consider blocking this person and/or reporting abuse
Top comments (1)
The door-vs-mandate distinction is the cleanest statement of the gap I've seen. OAuth answers 'who is calling', which stops mattering the moment the caller is a program pursuing a goal over hours - what you need is 'what may it do, for how long, and who can check without trusting the enforcer'. Third-party-verifiable is the property that will fight hardest in practice: every existing stack assumes the enforcer is the verifier. If draft-02 survives review with that intact, it becomes the missing noun between 'API key' and 'we logged everything'.