AAuth: the substrate that grew the object
The sharpest evidence for the fundamental-versus-accidental split arrived from outside this family. AAuth is Dick Hardt’s proposed agent-native authorization protocol, an active individual draft (revised through July 2026, and renamed draft-hardt-oauth-aauth-protocol along the way) that departs from OAuth’s redirect model rather than extending it: conversational, signed-request-first, with the Person Server as its governing party. It set out to rebuild agent authorization from a clean sheet, and in an early 2026 revision it grew the object this handbook argues for: a first-class mission layer, with a mission proposal and approval flow, an AAuth-Mission header on the wire, mission-aware token choreography, and Person Server governance endpoints. An independent derivation, starting from protocol design rather than authority invariants, landed on the same missing object. The convergence continues in the details: AAuth’s clarification chat, where an approver questions a proposal before consenting, is the interrogation channel the approval part records in Consent Evidence. That is the validation chapter’s convergence argument playing out at the protocol layer.
The honest reading of where it stands is the one the analysis works through: AAuth closed the “where is the mission layer” question and left the “what authority does the mission actually confer” question open, and the five laws are the yardstick to hold its model to as it matures, portable containment and lifecycle completeness rather than mission correlation and governance hooks. The family’s AAuth binding is the constructive answer: it hosts this model at the Person Server with issuance gating intact, so the two proposals converge instead of forking. The deep treatments are published: Mission Architecture on AAuth mapped the model onto the protocol before it had a mission layer, AAuth Now Has a Mission Layer re-ran the comparison after the revision, and Why Mission-Bound OAuth Might Be the Wrong Answer is the standing critique of the OAuth home itself.
The strategic position does not change, and it is worth restating with AAuth in full view: OAuth is the adoption path because it is where the deployments are, AAuth may prove the cleaner native substrate for the agents that come next, and the model, the laws, and the gate are built to survive either outcome. The falsifiable version of that sentence lives below, in where this could be wrong.
Where this could be wrong
An architecture document that only argues for itself is marketing, and an earlier post in this work’s ancestry asked openly whether Mission-Bound OAuth was the wrong answer. That discipline belongs in the handbook too, so here are the five bets most worth doubting, each with the evidence that would falsify it.
The admission-time bet. The model moves interpretation to admission, where an accountable authority, a human or a policy a human consented to, decides against committed inputs before any authority exists (who may approve). If agent work proves more emergent than that, if real tasks discover most of their authority mid-flight, then the discovery loop becomes the hot path instead of the exception, admission becomes the bottleneck no matter who staffs it, and deployments will choose between rubber-stamped ceilings and friction that drives them back to broad grants. Progressive authorization and policy approvers are the hedges, and they are young precisely because nobody yet knows the sustainable grain. The price per admission is at least falling: an approved expansion no longer costs a restart, because the harness rebinds the running session to the successor Mission. The falsifying evidence: expansion and exception rates that stay high after templates and organizational priors mature.
The issuer bet. The family puts the Mission at an issuer, the Authorization Server or the standalone MAS, because that is where approval, derivation, and revocation already live. But the work itself lives in harnesses and orchestrators, and the industry could consolidate governance there instead: the runtime platform as the source of truth for the task, with the identity stack reduced to credentials. The MAS binding hedges the deployment topology, not the ownership question. The falsifying evidence: harness vendors shipping proprietary task objects that win adoption without ever touching the token layer.
The composition bet. The family bets that the approved task must be a first-class object. The alternative is composition: policy engines, workflow state, and richer token claims, wired together carefully, might deliver bounded, revocable, attributable agent work with no new object at all. The family’s answer is that composition without a shared root loses exactly the properties that matter, cross-audience revocation, cross-hop audit join, integrity anchoring (what becomes possible only with a Mission), but that is an argument, not a deployment result. The falsifying evidence: production estates achieving task-bounded, task-revocable agent authority through composition alone, interoperably, without converging on a shared task object.
The portability bet. The family bets that Mission authority can travel: that the Authority Set, the subset rule, and Mission state can be projected across authorization domains without losing their meaning. Cross-domain reality is harsher. The downstream domain may not speak the parent’s authority vocabulary, may not be able to verify the upstream approval’s semantics, may disagree about what counts as narrower, and may honor an action that is locally permitted and globally outside the Mission, and revocation propagation across administrative boundaries is the same problem wearing its operational face. Cross-Domain Projection and the portable Mandate are the constructive answers, and conservative refusal is the fallback where translation cannot be trusted. The falsifying evidence: cross-domain deployments that abandon authority translation and fall back to local re-approval at every boundary, making the Mission a per-domain object after all.
The revocation bet. The laws price Termination as non-negotiable, and much of the family’s weight, state-gated issuance, Status, the freshness bounds, the offline chain’s state check, is the cost of making revocation reach everything. A capability-native world could decide that short expiry with no refresh is enough, accept the bounded staleness, and skip the central state dependency entirely, trading the kill switch for autonomy and offline verification. If the market accepts that trade at scale, the category as this handbook defines it loses its fourth law to a cheaper approximation. The falsifying evidence: serious deployments running attenuable tokens with no state source and eating the staleness without incident.
None of these is a reason to wait, because the wedge is small and the laws are cheap to hold even if the bindings move. But a reader deciding how hard to bet should know which parts are invariants and which are wagers, and the honest split is this: the laws and the claim gate are the invariants. The admission grain, the issuer home, the price of Termination, the necessity of the object itself, and the portability of its authority are the wagers, and deployment experience, not this handbook, will settle them.
Where the framework leads
The framework is the map. The build order is the journey, and it is deliberately staged: crawl with the issuance core, walk with the protocol MVP on ratified substrate, run up the Governed and High-Assurance Agent levels as the deployment earns them. Adopting Mission-Bound Authorization carries that blueprint, the ecosystem to compose with, the operational surfaces you will own, and the pieces the community still has to standardize.
The so-what of the framework is what it does for the laws. It makes them portable: state them once, realize them per substrate, and hold every competing proposal to the same five.
And that is the handbook’s last word: not a token format, but an object the stack can hold, laws it can enforce, and a claim anyone can test. If a law is wrong, a wager mispriced, or a binding missing, the issues on the draft repository are where the argument moves.