What happened
On 1 November 2026 (in-window), the individual Internet-Draft 'AAuth — Agentic Authorization OAuth 2.1 Extension' (draft-rosenberg-oauth-aauth) was updated to revision -02 (last updated 2026-11-01), replacing draft-patwhite-aauth. It analyses problems with using standard OAuth grant flows for AI agents and proposes an 'Agent Authorization Grant' (aauth) OAuth 2.1 extension that lets agents obtain scoped access tokens at resource-access time using Human-in-the-Loop or other approval flows.
Why it matters
It addresses a core agentic-AI security gap: granting agents least-privilege, on-demand, human-approved tokens rather than long-lived broad-scope credentials. This is a concrete protocol-level path for agent authorization that complements the WIMSE AI Identity Management System and other agent-identity work covered previously.
Action needed
Review if you are building OAuth-based agent authorization or comparing agent-token approaches; monitor for working-group adoption and comment to the OAuth WG if it is adopted.