The question worth asking about AAuth is not only whether the protocol is good. Kerberos won because of everything around the protocol: SSPI and GSS-API hid the mechanism from application developers, the LSA owned keys and ticket lifecycle, machine accounts existed as a side effect of domain join, Active Directory shipped the KDC by default, and SPNEGO made rollout incremental. Mapping that stack onto agents names the first control point in this series: the provider seam through which a harness or gateway acquires and presents credentials without exposing the mechanism to agent logic. MCP clients, SPIFFE, cloud identity systems, vendor brokers, and HTTP message-signature negotiation supply pieces, but no general seam composes them. That seam still cannot decide whose agent is running, which work is approved, or whether a resource permits one action. Those are separate records and decisions.
Agent runtimes naturally create the first trustworthy evidence about an instance, which gives them the default position in agent identity. Runtime proof and enterprise binding are still separate jobs. In heterogeneous enterprises, a binding layer can map evidence from many runtimes into durable Agent and Agent Deployment records and supply that governed context to credential issuers and resources. It is a real control plane only if the enterprise state survives changing runtimes. In the open world, model-provider harnesses are better positioned to integrate the stack because they hold the user relationship and execution loop. Distribution determines the default. Standard seams determine whether it can be challenged. Even a won binding layer answers whose agent is running, not whether its current work remains approved. That requires the third control point, an approved-task record with its own lifecycle.
Agent task authority is scattered across four de facto records: harness permission prompts, OAuth grants, IAM roles, and change tickets. Each performs a real job, but none is a general, portable system of record for approved work. An action click is not task approval, a grant is not a task lifecycle, and an identity role is not a reason for one undertaking. The missing object is an approved-task record with its own owner, bounds, lifecycle, and evidence relationships. Existing standards provide much of the transport for structured requests, user interaction, decisions, and credential projection. They do not yet supply shared task semantics, lifecycle propagation, trust, or enforcement behavior. Four plays are competing to mint the record, and the contest turns on distribution, durable state, and resource acceptance.
The control-points series argues that distribution determines defaults and standard seams determine whether those defaults remain contestable. MCP adds the clock. It launched with a specification, SDKs, a distributed host, and reference servers, and one developer could run the whole loop before the ecosystem coordinated. Mature authorization and governance followed the adoption pressure. The lesson is not that ratification is obsolete or that protocols can be adopted unilaterally. It is that a seam needs a small first coordination radius, immediate utility, low exposed implementation cost, running code, and a path from one controlled deployment to multilateral interoperability. This essay runs the series’ seam table through that test, uses AAuth as the clean-sheet stress test, and explains what would produce an enterprise ‘SAML moment’ for agents.
Cross App Access is not twenty-five generally available integrations. It is three different things at three different stages: a stable MCP authorization extension, a live Claude and Okta beta, and a partner graph whose broader product rollout is still under way. That distinction makes the strategic result clearer. The launch coalition moves protocol coordination from each buyer to the vendors assembling the loop, giving the layered identity play an adoption wedge. ID-JAG carries both the enterprise user and a required OAuth client identifier, while the resource authorization server retains the final decision. What it does not standardize is the binding from that client to a logical Agent, approved deployment, or runtime instance, nor a record of the task that justifies access. The credential-projection foothold shipped. The Agent and approved-work records remain open.
Long-running agents discover mid-task that they need a destination their egress proxy does not allow, and the block comes back as an opaque connection failure with no machine-actionable way to ask for access and no human standing by. That block is a requestable denial, and the egress proxy is a policy enforcement point. RFC 8908, the Captive Portal API, supplies the recovery state machine for a blocked client on a network: discover captivity, learn the remediation endpoint, and retry after policy changes. A headless agent can use that state machine, with the denial carried by Proxy-Status and Problem Details where an HTTP response exists and by an authenticated side-channel status API where it does not. The recovery can ride the captive portal at two altitudes, destination-level on a proposed AuthZEN Access Request profile or operation-level on AAuth and Mission-bound authority. When the client already speaks AAuth, it needs no captive-portal shim at all, because AAuth carries the refusal and re-authorization in-band at the same request boundary the proxy already enforces.
Model routers and customer-controlled agent state are now concrete product architectures, but they do not make every model interchangeable or every memory store strategic. The important boundary is narrower. Task checkpoints are operational state, transcripts are evidence, embeddings are derived indexes, and model-generated memories are untrusted proposals. Canonical institutional knowledge becomes an enterprise record only when the company can govern its meaning, provenance, lifecycle, access, retention, and portability. That record feeds a context compiler, which builds a purpose-bounded view for an approved task, and a router, which selects an execution supplier. Reads are exposure decisions, and writes are changes to future behavior. The approved-task record should bound both without being confused with the memory itself. A vendor may operate the store, but the record must remain intelligible, governable, and recoverable when the vendor changes.
The Four Questions of Delegated Work, and the Invariants That Compose Their Answers
Delegated work forces four separate continuity questions: request provenance, identity attribution, target-applicable authority, and continuing work justification. Their answers compose through a common boundary contract: authoritative sources, bound and correlated evidence, explicit lifecycle semantics, local decisions, and declared failure behavior. Current proposals fill different parts of that contract; narrow profiles adopted one boundary at a time offer a more credible path than one universal delegation artifact.
A Vocabulary, a Rubric, and a Living Map for the Four Questions
Continuity Is Not One Thing argues that delegated work poses four independently governed continuity questions. This companion carries the parts built to be revised rather than to last: a vocabulary that separates facts from evidence, artifacts, authorities, decisions, and state; a twelve-question rubric a working group can apply to any proposal without accepting anyone’s architecture; worked evaluations of Transaction Tokens and Identity Chaining; the sixteen active OAuth working-group documents classified against the framing; and the two-layer standards map with dated versions and statuses.
The enterprise agent control stack is not one product or one call chain. It is a set of independently governed answers: which instance is running, whose Agent it is, which deployment was approved, why its current work remains authorized, what an issuer may project, how credentials are acquired and presented, whether a resource permits one concrete action, and which evidence proves the joins afterward. Three upstream positions are contested control points: the provider seam, identity binding, and the approved-task record. The resource decision remains the non-delegable final word, while runtime evidence, issuance, and audit support the chain without substituting for its records. The context and memory plane crosses this path but does not merge with it: approved work bounds exposure and memory-write rights, while canonical institutional memory keeps its own lifecycle. Six rules, one forward-and-reverse trace, and five component-replacement tests turn the series into an architecture and procurement tool.