Flows
How an agent actually gets in
Sequence-style walkthroughs of the patterns that show up in design reviews: user-delegated API calls, AAuth p2p modes, MCP as an OAuth client, A2A, on-behalf-of chaining, CIBA, and workload-plus-user. For the other cut — how the agent is deployed, and which protocols attach to that runtime — see deployment patterns.
User-delegated
User-delegated agent calling APIs
A human authorizes an agent (as an OAuth client) to call an API. OAuth 2.1 + PKCE + audience-restricted JWT access tokens. This is still the production default.
Peer / p2p
Peer-to-peer: AAuth identity-based access
No authorization server in the path. The agent signs the request; the resource decides from cryptographic identity. This is the 'p2p' that sits next to AAuth.
Peer / p2p
Peer-to-peer: AAuth two-party (resource-managed)
Still no external AS. The resource runs consent/account creation itself, then issues an opaque session token for subsequent signed calls.
Agent as client
Agent host as OAuth client (MCP HTTP)
The MCP client discovers how to authorize from Protected Resource Metadata and performs OAuth 2.1. The model never sees a protocol other than 'call this tool'.
Agent as resource
Agent as resource (others call it)
Your agent exposes an HTTP API or A2A skill. Callers authenticate using whatever the Agent Card or Protected Resource Metadata advertises.
Peer / p2p
Agent-to-agent tasks (A2A)
Discovery and task delegation between opaque agents. Authentication is declared, not invented: OAuth, OIDC, mTLS, or API keys.
User-delegated
AAuth three-party (PS-asserted user claims)
The resource has no AS of its own. It accepts identity claims from the agent's person server after the user consents at the PS.
Multi-hop
Multi-hop on-behalf-of (Token Exchange + chaining)
The user authorizes Agent A. A calls Service B. B must call API C in another domain without pretending to be the user or widening scope.
Human approval
Human-in-the-loop via CIBA
The agent is unattended. It needs a specific approval on the user's phone before a sensitive tool runs.
Multi-hop
Workload identity plus user delegation
SPIFFE/WIMSE proves which agent binary is calling. OAuth proves which user it may act for. Both are required in production meshes.