letsauth

Agent auth atlas

The standards that decide how agents are authorized, and how they relate

One map of the OAuth extensions, workload identity drafts, agent protocols, credential formats and EU acts that an agent, an MCP server or an identity provider has to follow. Every node is a specification with dated revisions; every line is a typed relation with a note on what it is based on.

41 specifications67 relations9 publishing bodies

Recently revisedWIMSE Applicability for AI Agents AAuth Protocol AI Identity Management System (AIMS) The OAuth 2.1 Authorization Framework SD-JWT-based Verifiable Digital Credentials (SD-JWT VC)

Relation types
Publishing bodies

41 of 41 specifications, 67 of 67 relations

Specifications for agent authorization, one node each, grouped by publishing body in rows and by what they build on in columns, with their relations drawn as lines. IETF OAuthpublishedThe OAuth 2.0Authorization FrameworkIETF OAuthpublishedJSON Web Token (JWT)Profile for OAuth 2.0…IETF OAuthpublishedOAuth 2.0 Dynamic ClientRegistration ProtocolIETF OAuthpublishedProof Key for CodeExchange by OAuth Publi…IETF OAuthpublishedOAuth 2.0 AuthorizationServer MetadataIETF OAuthpublishedOAuth 2.0 Token ExchangeIETF OAuthpublishedResource Indicators forOAuth 2.0IETF OAuthWG draftThe OAuth 2.1Authorization FrameworkIETF OAuthpublishedJSON Web Token (JWT)Profile for OAuth 2.0…IETF OAuthpublishedOAuth 2.0 AuthorizationServer Issuer…IETF OAuthpublishedOAuth 2.0 RichAuthorization RequestsIETF OAuthcandidateSD-JWT-based VerifiableDigital Credentials…IETF OAuthpublishedOAuth 2.0 DemonstratingProof of Possession…IETF OAuthcandidateTransaction TokensIETF OAuthWG draftIdentity Assertion JWTAuthorization GrantIETF OAuthWG draftOAuth Client ID MetadataDocumentIETF OAuthpublishedBest Current Practicefor OAuth 2.0 SecurityIETF OAuthpublishedOAuth 2.0 ProtectedResource MetadataIETF OAuthpublishedSelective Disclosure forJSON Web Tokens (SD-JWT)IETF OAuthdraftAAuth ProtocolOpenIDpublishedOpenID Connect Core 1.0OpenIDpublishedOpenID Connect Discovery1.0OpenIDpublishedOpenID Federation 1.0OpenIDpublishedOpenID for VerifiablePresentations 1.0OpenIDpublishedOpenID for VerifiableCredential Issuance 1.0OpenIDWG draftAuthZEN COAZ Binding forthe Model Context…IETF WIMSEWG draftWorkload Identity in aMulti System Environmen…IETF WIMSEdraftWIMSE Applicability forAI AgentsIETF WIMSEWG draftAI Identity ManagementSystem (AIMS)IETF WIMSEWG draftWIMSE WorkloadCredentialsIETFdraftDiscovery of Agents WithNames (DAWN)OtherpublishedVerifiable CredentialsData Model 2.0MCPpublishedMCP AuthorizationMCPpublishedMCP Enterprise-ManagedAuthorizationA2ApublishedAgent2Agent (A2A)ProtocolVendorpublishedCross App Access (XAA)Vendorpublishedauth.mdEUin forceNIS 2 DirectiveEUin forceEuropean DigitalIdentity Framework…EUin forceArtificial IntelligenceActEUpublishedEUDI Wallet Architectureand Reference Framework
Rows are publishing bodies; a specification sits one column right of what it builds on, profiles or replaces. Hover a line for the relation; thelist below carries the same information as text.

Legend

builds on
Depends on the other document's mechanisms and cannot be used without them.
profiles
Narrows the other document's options for one setting without changing it.
replaces
Supersedes the other document; the older one stays for history.
references
Cites the other document normatively or for a specific mechanism.
competes with
Proposes a different answer to the same question; the note says how.
solves the same problem as
Addresses the same need by a different route without competing for adoption.
Individual draft
Individual draft is the publisher's status, not a grade.
Working group draft
Working group draft is the publisher's status, not a grade.
Candidate
Candidate is the publisher's status, not a grade.
Published
Published is the publisher's status, not a grade.
In force
In force is the publisher's status, not a grade.

Every specification on the map

IETF OAuth

OpenID Foundation

IETF WIMSE

IETF (other)

Other bodies

MCP

A2A

Vendor

European Union

Withdrawn

Withdrawn documents leave the map but keep their page and their relations.