Agent task authority is scattered across four de facto records: harness permission prompts, OAuth grants, IAM roles, and change tickets. Each performs a real job, but none is a general, portable system of record for approved work. An action click is not task approval, a grant is not a task lifecycle, and an identity role is not a reason for one undertaking. The missing object is an approved-task record with its own owner, bounds, lifecycle, and evidence relationships. Existing standards provide much of the transport for structured requests, user interaction, decisions, and credential projection. They do not yet supply shared task semantics, lifecycle propagation, trust, or enforcement behavior. Four plays are competing to mint the record, and the contest turns on distribution, durable state, and resource acceptance.
Long-running agents discover mid-task that they need a destination their egress proxy does not allow, and the block comes back as an opaque connection failure with no machine-actionable way to ask for access and no human standing by. That block is a requestable denial, and the egress proxy is a policy enforcement point. RFC 8908, the Captive Portal API, supplies the recovery state machine for a blocked client on a network: discover captivity, learn the remediation endpoint, and retry after policy changes. A headless agent can use that state machine, with the denial carried by Proxy-Status and Problem Details where an HTTP response exists and by an authenticated side-channel status API where it does not. The recovery can ride the captive portal at two altitudes, destination-level on a proposed AuthZEN Access Request profile or operation-level on AAuth and Mission-bound authority. When the client already speaks AAuth, it needs no captive-portal shim at all, because AAuth carries the refusal and re-authorization in-band at the same request boundary the proxy already enforces.
OAuth, WIMSE, and OpenID, Mapped to the Architecture
The Mission is the architecture’s new primitive. The rest should compose. This appendix tests that claim against the ratified OAuth substrate, the complete active OAuth and WIMSE working-group queues, selected individual drafts, and the relevant OpenID Foundation specifications. It separates publication status from architectural relationship and states the important deltas and substitution hazards plainly.
The handbook argues the architecture. This appendix shows the bytes: a Mission Intent submitted through PAR, the approved record’s integrity anchors, a Mission-bound access token, an AuthZEN permit bound to parameters, a parameter_violation denial, the revocation that ends the task, the lifecycle event that announces it, and the status check that fails the 02:00 resume. Every exhibit follows the current editor’s copies, and the two integrity anchors reproduce byte for byte.
Mission-based authorization governs the approved task, not just the credential, session, or request. This page is the field reference: the definition and litmus test for what counts as mission-based, a competitive landscape, the adoption stages, threats and non-goals, the canonical diagram and glossary, and the Q3 board-packet example threaded through the handbook.
The least-privilege MCP series ends on a gap: token-side and resource-side authorization both work per call, and neither names the task the user approved. This essay applies Mission-Bound Authorization at the MCP boundary. The Mission is the durable approved task, tokens and PDP decisions are projections of it, tool discovery and invocation and approval line up against it, expansion routes through a fresh approval, and audit joins on one identifier. A denial is traced end to end to show the whole spine working.
Issuance gating and runtime enforcement are two independent chokepoints, strictly stronger together: a gap in PEP coverage is still bounded at the token layer, and an outstanding token is still stopped at the action layer. The Mission Authority Server, the issuance grant, the Mandate, and Cross-Domain Projection extend the pattern space. And the structural reading that platform engineers reach for unprompted: the layer is the control plane for delegated authority, mapped concept by concept from desired state to the fleet API, with the disciplines that keep the framing honest.
Simon Willison named the combination that makes agents dangerous: access to private data, exposure to untrusted content, and the ability to communicate externally, held together in one loop. Any two legs are safe. All three are an exfiltration machine waiting for a poisoned document. This part runs the handbook against that threat model: the three legs become separately typed action classes under one Mission, the external leg becomes a consequential action that needs a fresh parameter-bound permit, mediated custody keeps the egress credential out of the agent’s hands, and the harness downgrades egress once untrusted content enters the session. Then the honest residuals: enforcement scope, composition, and the semantic gap.
The first five layers make the Mission approvable, enforceable, governable, and delegable. This operational close makes them hold up against a real agent: a harness that treats session continuity as recoverable state and not as authority, an orchestrator that unwinds work already in flight when a Mission stops, and a transparency profile that makes the suite’s evidence independently verifiable across trust domains. It closes with a synthesis of the six operational layers and the Mission Assurance Levels, the practice-side view of the adoption path the architecture chapter stages.
The issuance core gives a Mission three states and gates derivation on active. This part adds the surfaces that make state actionable over time: Status for canonical pull freshness with Signals as its push complement, Expansion for governed growth, and Completion for monotonic narrowing. One rule threads through all four. Only active permits reliance, so every state a newer profile adds fails safe for a consumer that predates it.
OAuth issuance bounds what authority may exist. It does not check the action at the point of use, so an active Mission becomes ambient authority within a token’s lifetime. The runtime layer closes that gap. A PEP at each consequential execution boundary obtains a permit from a PDP that evaluates the action, its parameters, the actor, and the current Mission state before any consequential effect occurs. The runtime profile fixes the invariants. The AuthZEN profile is its concrete wire binding.
The AI agent auth best practices give an agent workload identity, credentials, and delegated user authority. This part binds Mission authority to that identity. The mission claim projects the approved task into every derived token, attested instance identifiers and actor chains keep every actor attributable, and delegated work gets explicit, narrower, separately revocable authority. A sub-agent that acts because it descends from a parent session is inheriting ambient authority, not delegated authority. Child Missions give durable sub-agents their own revocable handles with strict-subset authority and cascade revocation. Offline attenuation, the experimental roadmap for fan-out at scale, keeps the Authorization Server off the hot path with the runtime state check as the surviving kill switch.
A user request is untrusted input. This part covers the integrity of the approval event, the layer before any token exists: the client-side shaper that proposes a candidate Mission Intent, the Consent Evidence that commits the structured consent disclosure the Authorization Server recorded as rendered (not the pixels or the Approver’s comprehension), and the deferred and revisable approval that lets a human reviewer narrow a proposal in place. Authority is created only when the Authorization Server validates, narrows, and approves.
A definitive architecture that ends without a build order is a tour, not a blueprint. Most estates start at the read-only ceiling: agents capped at read access, humans approving or executing the writes, and pilots that never graduate. This closer names what that posture costs and stages the way off it: crawl by shipping the issuance core (approved, integrity-anchored Missions and a possession-independent kill switch, honestly labeled governance rather than safety), walk by adding the Runtime-Enforced level (per-action enforcement, the AuthZEN binding, and Status freshness, all on substrate that already shipped), and run by climbing to the Governed and High-Assurance Agent levels, each of which makes a broader class of write authority defensible. Plus the ecosystem to compose with, the five operational surfaces you will own, and the pieces the community still has to standardize.
The AI agent auth best-practices draft names the Mission and declares its translation into authorization out of scope. This is the core argument on the other side of that line: why the approved task is the missing object above authentication and instance identity, how the argument converged, the Mission-versus-Intent boundary, and where to start. The definitions, object model, lifecycle, and glossary live in the Reference.
Part one laid out two ways to lock down a single tool call an agent makes through the Model Context Protocol: carry a narrow token, or let the resource decide each call. This part walks the standards that close the gaps. AuthZEN gives a standard way to ask the policy question, the Access Request and Approval Profile turns a denial into a governed request for approval, and a set of proposals carries that approval over the wire. Each makes one call’s authorization more interoperable, and none gives a multi-step task a shared identity. So a string of individually correct calls can still drift from what the user approved. The missing piece is a durable, governed record of the approved task, the object I call a Mission.
There are two natural ways to lock an agent’s Model Context Protocol (MCP) tool calls down to least privilege. The agent can carry a narrow token scoped to the action, or the server can decide each call as it happens. Carrying a token gives portable proof of what the agent may do, but pushes domain knowledge onto the authorization server and token management onto the client. Deciding at the resource keeps the meaning where it lives, but the decision is not portable. MCP makes the tool boundary first-class for both. This part compares the two models and how to choose. Part two covers the standards that close the per-call gaps and the task object neither names.
Closed-world authorization treated denial as the end of the interaction. Agents, runtime discovery, delegation, and mission expansion turn denial into the beginning of governance escalation. The draft AuthZEN access request and approval profile standardizes that handoff without standardizing the workflow engines behind it. Client-Initiated Backchannel Authentication (CIBA) is not the answer because the problem is not authentication freshness. It is whether authority should continue under newly discovered runtime conditions.