OAuth, WIMSE, and OpenID, Mapped to the Architecture
The Mission is the architecture’s new primitive. The rest should compose. This appendix tests that claim against the ratified OAuth substrate, the complete active OAuth and WIMSE working-group queues, selected individual drafts, and the relevant OpenID Foundation specifications. It separates publication status from architectural relationship and states the important deltas and substitution hazards plainly.
The handbook argues the architecture. This appendix shows the bytes: a Mission Intent submitted through PAR, the approved record’s integrity anchors, a Mission-bound access token, an AuthZEN permit bound to parameters, a parameter_violation denial, the revocation that ends the task, the lifecycle event that announces it, the status check that fails the 02:00 resume, and the refresh the token endpoint refuses after revocation. Every exhibit follows the current editor’s copies, and the two integrity anchors reproduce byte for byte.
Mission-based authorization governs the approved task, not just the credential, session, or request. This page is the field reference: the definition and litmus test for what counts as mission-based, a competitive landscape, the adoption stages, threats and non-goals, the canonical diagram and glossary, and the Q3 board-packet example threaded through the handbook.
The handbook closes on judgment. First the strongest outside evidence: AAuth, the proposed clean-slate agent protocol, adopted a first-class mission layer in its 01 revision after this model’s AAuth mapping circulated: not independent replication, adoption by a designer free to say no, which is its own kind of proof. Then the bets: admission grain, issuer home, the price of Termination, the necessity of the object itself, the portability of its authority, and the classification line, each stated with the evidence that would falsify it. The laws and the claim gate are the invariants. The bets are the wagers, and deployment experience, not this handbook, will settle them.
Issuance gating and runtime enforcement are two independent chokepoints, strictly stronger together: a gap in PEP coverage is still bounded at the token layer, and an outstanding token is still stopped at the action layer. The Mission Authority Server, the issuance grant, the Mandate, and Cross-Domain Projection extend the pattern space. And the structural reading that platform engineers reach for unprompted: the layer is the control plane for delegated authority, mapped concept by concept from desired state to the fleet API, with the disciplines that keep the framing honest.
OAuth is the first binding, on the most deployed infrastructure, but the model does not depend on it. This part states the framework the profiles realize: four functions (compilation, projection, containment, continuity), a verb spine of ten verbs from propose to analyze, and the fundamental-versus-accidental test. Which ideas survive if OAuth disappears? Nearly all of them: the layer, the laws, the vocabulary, the approved task with an integrity-anchored record, approval evidence, runtime containment. What is accidental is the realization: PAR, RAR, the claim names, the wire shapes.
Agents break OAuth’s assumption that consent happens once, upfront, with the user present. An agent authorization gap catalog from the OAuth working group’s orbit names eleven scenarios and six major gaps, and its own picnic example shows three of them at once: the consent prompt loses the request’s context, an action inside a valid grant runs with no one approving it, and cancelling the task does not reach the permissions that serve it. Those gaps need one connection, an approved task that later credentials, decisions, delegations, and revocations can identify. The Mission proposes that connection, and each enforcement layer still has obligations of its own. Three requirements stay partly open: the human’s own signature on an execution-time consent, one budget shared across administrative domains, and trust between strangers. The crosswalk maps every row with its source section, and the part closes on a test any design can run.
The first five layers make the Mission approvable, enforceable, governable, and delegable. This operational close makes them hold up against a real agent: a harness that treats session continuity as recoverable state and not as authority, an orchestrator that unwinds work already in flight when a Mission stops, and a transparency profile that makes the suite’s evidence independently verifiable across trust domains. It closes with a synthesis of the six operational layers and the Mission Assurance Levels, the practice-side view of the adoption path the architecture chapter stages.
The issuance profile gives a Mission three states and gates derivation on active. This part adds the surfaces that make state actionable over time: Status for canonical pull freshness with Signals as its push complement, Expansion for governed growth, and Completion for monotonic narrowing. One rule threads through all four. Only active permits reliance, so every state a newer profile adds fails safe for a consumer that predates it.
OAuth issuance bounds what authority may exist. It does not check the action at the point of use, so an active Mission becomes ambient authority within a token’s lifetime. The runtime layer closes that gap. A PEP at each consequential execution boundary obtains a permit from a PDP that evaluates the action, its parameters, the actor, and the current Mission state before any consequential effect occurs. The runtime profile fixes the invariants. The AuthZEN profile is its concrete wire binding.
AIMS, the WIMSE working group’s AI agent identity document, gives an agent workload identity, credentials, and delegated user authority. This part binds Mission authority to that identity. The mission claim projects the approved task into every derived token, instance identity (under an instance-unique key) and actor chains keep every actor attributable, and delegated work gets explicit, narrower, separately revocable authority. A sub-agent that acts because it descends from a parent session is inheriting ambient authority, not delegated authority. Child Missions give durable sub-agents their own revocable handles with strict-subset authority and cascade revocation. Offline attenuation, the Evaluate-only roadmap item for fan-out at scale, keeps the Authorization Server off the hot path with the runtime state check as the surviving kill switch.
A user request is untrusted input. This part covers the integrity of the approval event, the layer before any token exists: the client-side shaper that proposes a candidate Mission Intent, the Consent Evidence that commits the structured consent disclosure the Authorization Server recorded as rendered (not the pixels or the Approver’s comprehension), and the deferred and revisable approval that lets a human reviewer narrow a proposal in place. Authority is created only when the Authorization Server validates, narrows, and approves.
A definitive architecture that ends without a build order is a tour, not a blueprint. Most estates start at the read-only ceiling: agents capped at read access, humans approving or executing the writes, and pilots that never graduate. This closer names what that posture costs and stages the way off it: crawl by shipping the issuance profile (approved, integrity-anchored Missions, a possession-independent kill switch, and writes whose bounds the receiving Resource Server enforces), walk by adding the Runtime-Enforced level (per-action enforcement, the AuthZEN profile, and Status freshness, for parameter-bound writes and bounds finer than the Resource Server checks), and run by adding the Governed and High-Assurance Agent levels for unattended agents, delegation, and the high-consequence classes. Plus the ecosystem to compose with, the six operational surfaces you will own, and the pieces the community still has to standardize.
The AI agent auth best-practices draft names the Mission and declares its translation into authorization out of scope. This is the core argument on the other side of that line: why the approved task is the missing object above authentication and instance identity, how the argument converged, the Mission-versus-Intent boundary, and where to start. The definitions, object model, lifecycle, and glossary live in the Reference.
What the Corporate Card Already Solved walked a working delegated-authority architecture one control at a time and never mentioned a protocol. This part is the joint between that mental model and this chapter’s architecture. The five rules the card world taught become the five laws of delegated authority, stated for any substrate. The corporate-card test becomes the claim gate a vendor claim must pass. And the build lists that closed each card post, the things the agent stack cannot borrow from the expense world, turn out to enumerate the draft family: disclosure integrity, field-speed narrowing, checkpoints per boundary, endings that propagate, and a record that earns trust without a bank.
Identity Assertion Trust Framework and Domain-Authorized Issuer Trust Method
Self-service agent sign-up exposes a first-contact trust problem: a Resource Authorization Server can verify a perfectly valid JWT and still not know whether the issuer is allowed to assert identities for the user’s domain. That is two questions, not one. Federation proves the issuer is authentic, but not that the namespace owner authorized it, and static allowlists do not scale to onboarding unknown domains at runtime. The Identity Assertion Trust Framework lets a Resource AS publish the evidence it requires. The Domain-Authorized Issuer Trust Method lets a domain owner publish which issuers may assert identities in its namespace, fail-closed, the way mail and the web already pushed authority into DNS. Both compose with ID-JAG and the JWT-bearer grant without changing the grant surface.
OAuth answers whether a request is permitted right now. Mission-Bound OAuth asks whether a delegated mission should still be running at all. This RFC proposes a durable Mission object at the Authorization Server that governs token derivation, lifecycle, delegation, and termination across agent execution.