Series

11 Articles

Mission-Bound OAuth

Superseded by the Mission-Bound Authorization draft family, kept as history. Four posts on Mission-Bound OAuth: the core architecture, the Client Context / ID-JAG companion profile, the AAuth mapping, and a final critique of the architecture itself.

Mission Shaping

Many current agent deployments skip the step that turns approved intent into bounded authority. This two-part series covers the Mission shaping problem and why even a well-shaped Mission is not enough once an agent is running in the world.

Open-World OAuth

OAuth succeeded in closed worlds. Agents are pushing it into open-world authorization, where discovery, resource binding, and first-contact trust have to work before governance can. This series separates the substrate problem from the Mission shaping problem and explains why agent authorization needs both layers to hold.

Least-Privilege MCP Tool Calls

Least-privilege MCP tool calls have two natural authorization paths: carry narrow authority in a token, or decide each call at the resource. This series compares the models, explains the standards around decisions, failure signaling, and requestable denials, and isolates the gap none of them closes: the missing task object.

What the Corporate Card Already Solved

Enterprises already run a mature delegated-authority architecture. It is called expense governance, and payments spent fifty years hardening it: purpose-issued instruments, approvals bound to what the approver was shown, delegation that only narrows, a network that authorizes every transaction, and cancellations, disputes, and statements that close the loop. This chapter walks that world one control at a time and maps each onto what AI agents are missing, honestly, breaks included.

Designing Mission-Bound Authorization

The AI agent auth best-practices draft names the Mission and declares its translation into authorization out of scope. This chapter is that translation, at architecture depth: the problem in one screen, the vocabulary, the missing layer, the five laws, the reference security architecture, and the canonical picture. Part 1 is the joint between the card model and the protocol. Part 2 defines the Mission. Part 3 stages the adoption: crawl, walk, run. The Field Reference rides alongside as the appendix, and the concluding chapter weighs the model beyond its bindings.

Building Mission-Bound Authorization

Designing Mission-Bound Authorization establishes the architecture: the object, the laws, the framework, and the staged adoption path. This chapter is the build. Five parts carry the five controls at implementation depth: the approval that creates a Mission, the authority that binds it to agent instances and delegates, the per-action enforcement that polices it, the lifecycle that governs it over time, and the runtime and audit story that make it survive a real agent. The wire appendix shows the actual bytes, and the MCP application post applies the model at the tool boundary.

Testing Mission-Bound Authorization

An architecture that only answers its own questions is untested. This chapter runs the handbook against five outside framings: Simon Willison’s lethal trifecta, the threat model that defines what makes agents dangerous. Patrick Parker’s Seven Laws of AIdentity, mapped law by law with coverage and caveats stated rather than claimed whole. OWASP’s agentic threat taxonomy and LLM Top 10, where every threat gets a verdict of contained, bounded, or delegated. The governance frameworks, NIST AI RMF, the EU AI Act, and ISO/IEC 42001, whose show-me demands the enforcement artifacts answer as a by-product. And the OAuth community’s agent authorization gap catalog, its gaps answered line by line with the machinery that existed before the catalog was published. Each post names what the handbook answers with existing machinery, and what it honestly does not.

Weighing Mission-Bound Authorization

A handbook that ends on its own argument has not concluded, it has just stopped. This chapter is the conclusion: what survives if OAuth disappears (nearly everything: the layer, the laws, the vocabulary, the object), where the layer sits operationally (the control plane for delegated authority, mapped concept by concept with the disciplines that keep the framing honest), and the judgment a reader deciding how hard to bet actually needs: AAuth’s adoption of the Mission concept as the outside evidence, weighed for what adoption proves, and the six wagers, each with its falsifier.

Agent Control Points

Who controls the agent stack is being decided at three upstream control points. The provider seam decides how agents acquire and present credentials. The binding layer decides whose Agent an instance is and which approved deployment it runs. The approved-task record decides why authority exists and when it ends, and no general interoperable form exists yet. Resources retain a fourth, final decision that no upstream record can command, and issuers project the upstream records into short-lived credentials without becoming authoritative for any of them. One couplet threads the contests: distribution determines the default, and standard seams determine whether the default can be challenged. The MCP companion adds the clock by testing each seam’s adoption wedge and coordination radius. The Cross App Access companion applies that test to a live consortium-scale credential-projection foothold, and the captive-client companion supplies the recovery pattern for the agent that hits an enforcement point mid-task. A fourth separates the intelligence layer, where governed institutional memory must outlive the models, harnesses, and stores that touch it. A capstone assembles the six rules, the control path on one page, and the replacement tests.