You Don't Give Agents Credentials. You Grant Them Power of Attorney.
You’ve been giving AI agents credentials. You should have been giving them Power of Attorney. Three posts on the structural gap in enterprise IAM and what it takes to close it.
Series
10 Articles
Mission-Bound OAuth
Superseded by the Mission-Bound Authorization draft family, kept as history. Four posts on Mission-Bound OAuth: the core architecture, the Client Context / ID-JAG companion profile, the AAuth mapping, and a final critique of the architecture itself.
Mission Shaping
Many current agent deployments skip the step that turns approved intent into bounded authority. This two-part series covers the Mission shaping problem and why even a well-shaped Mission is not enough once an agent is running in the world.
Open-World OAuth
OAuth succeeded in closed worlds. Agents are pushing it into open-world authorization, where discovery, resource binding, and first-contact trust have to work before governance can. This series separates the substrate problem from the Mission shaping problem and explains why agent authorization needs both layers to hold.
Least-Privilege MCP Tool Calls
Least-privilege MCP tool calls have two natural authorization paths: carry narrow authority in a token, or decide each call at the resource. This series compares the models, explains the standards around decisions, failure signaling, and requestable denials, and isolates the gap none of them closes: the missing task object.
What the Corporate Card Already Solved
Enterprises already run a mature delegated-authority architecture. It is called expense governance, and payments spent fifty years hardening it: purpose-issued instruments, approvals bound to what the approver was shown, delegation that only narrows, a network that authorizes every transaction, and cancellations, disputes, and statements that close the loop. This chapter walks that world one control at a time and maps each onto what AI agents are missing, honestly, breaks included.
Designing Mission-Bound Authorization
The AI agent auth best-practices draft names the Mission and declares its translation into authorization out of scope. This chapter is that translation, at architecture depth: the problem in one screen, the vocabulary, the missing layer, the five laws, the reference security architecture, and the canonical picture. Part 1 is the joint between the card model and the protocol. Part 2 defines the Mission. Part 3 stages the adoption: crawl, walk, run. The Field Reference rides alongside as the appendix, and the concluding chapter weighs the model beyond its bindings.
Building Mission-Bound Authorization
Designing Mission-Bound Authorization establishes the architecture: the object, the laws, the framework, and the staged adoption path. This chapter is the build. Five parts carry the five controls at implementation depth: the approval that creates a Mission, the authority that binds it to agent instances and delegates, the per-action enforcement that polices it, the lifecycle that governs it over time, and the runtime and audit story that make it survive a real agent. The wire appendix shows the actual bytes, and the MCP application post applies the model at the tool boundary.
Testing Mission-Bound Authorization
An architecture that only answers its own questions is untested. This chapter runs the handbook against five outside framings: Simon Willison’s lethal trifecta, the threat model that defines what makes agents dangerous. Patrick Parker’s Seven Laws of AIdentity, mapped law by law with coverage and caveats stated rather than claimed whole. OWASP’s agentic threat taxonomy and LLM Top 10, where every threat gets a verdict of contained, bounded, or delegated. The governance frameworks, NIST AI RMF, the EU AI Act, and ISO/IEC 42001, whose show-me demands the enforcement artifacts answer as a by-product. And the OAuth community’s agent authorization gap catalog, its gaps answered line by line with the machinery that existed before the catalog was published. Each post names what the handbook answers with existing machinery, and what it honestly does not.
Weighing Mission-Bound Authorization
A handbook that ends on its own argument has not concluded, it has just stopped. This chapter is the conclusion: what survives if OAuth disappears (nearly everything: the layer, the laws, the vocabulary, the object), where the layer sits operationally (the control plane for delegated authority, mapped concept by concept with the disciplines that keep the framing honest), and the judgment a reader deciding how hard to bet actually needs: AAuth’s adoption of the Mission concept as the outside evidence, weighed for what adoption proves, and the six wagers, each with its falsifier.