Flows
How an agent actually gets in
User-delegated·16 hops
User-delegated agent calling APIs
A human authorizes an agent (as an OAuth client) to call an API. OAuth 2.1 + PKCE + audience-restricted JWT access tokens. This is still the production default.
Peer / p2p·6 hops
Peer-to-peer: AAuth identity-based access
No authorization server in the path. The agent signs the request; the resource decides from cryptographic identity. This is the 'p2p' that sits next to AAuth.
Peer / p2p·8 hops
Peer-to-peer: AAuth two-party (resource-managed)
Still no external AS. The resource runs consent/account creation itself, then issues an opaque session token for subsequent signed calls.
Agent as client·12 hops
Agent host as OAuth client (MCP HTTP)
The MCP client discovers how to authorize from Protected Resource Metadata and performs OAuth 2.1. The model never sees a protocol other than 'call this tool'.
Agent as resource·4 hops
Agent as resource (others call it)
Your agent exposes an HTTP API or A2A skill. Callers authenticate using whatever the Agent Card or Protected Resource Metadata advertises.
Peer / p2p·4 hops
Agent-to-agent tasks (A2A)
Discovery and task delegation between opaque agents. Authentication is declared, not invented: OAuth, OIDC, mTLS, or API keys.
User-delegated·14 hops
AAuth three-party (PS-asserted user claims)
The resource has no AS of its own. It accepts identity claims from the agent's person server after the user consents at the PS.
Multi-hop·8 hops
Multi-hop on-behalf-of (Token Exchange + chaining)
The user authorizes Agent A. A calls Service B. B must call API C in another domain without pretending to be the user or widening scope.
Human approval·7 hops
Human-in-the-loop via CIBA
The agent is unattended. It needs a specific approval on the user's phone before a sensitive tool runs.
Multi-hop·5 hops
Workload identity plus user delegation
SPIFFE/WIMSE proves which agent binary is calling. OAuth proves which user it may act for. Both are required in production meshes.