49-00 Why OAuth and OIDC Break for Agents 1 hr
AI agents are not human users and not static machines, but every identity system we have only handles those two. OAuth was designed for a human clicking a consent screen. OIDC assumes a browser redirect. When an autonomous agent runs at 3am with no human present, the consent model collapses, refresh tokens sit unattended, and "act as the user" delegation stops making sense. This module walks through the specific failure modes: consent without a human, token lifetimes longer than agent lifetimes, no way to attribute actions to the agent vs the user, and scope models that cannot express what an agent actually needs.
49-01 Agent-as-Itself Identity 1 hr
The fundamental shift happening across the industry: instead of an agent borrowing a user's identity, the agent holds its own. It presents its own credentials, earns its own trust score, and is accountable in its own right. This changes authorization (the agent's permissions are not the user's permissions), audit (the log says which agent, not which user), and liability (who is responsible when the agent acts). We cover what "agent-as-itself" means in practical terms, how it differs from service accounts, and why it matters for compliance.
49-02 Cross-App Access 1 hr
Cross-App Access is a proposal for how an agent running inside one application can securely call into another application on behalf of its operator. It addresses the problem that today an agent either gets the user's full token (too much access) or gets nothing (no interoperability). We walk through how Cross-App Access scopes the grant, what the trust model looks like between the two applications, and where it sits relative to OAuth client credentials.
49-03 ID-JAG (Inter-Domain JWT Agent Grants) 1 hr
ID-JAG defines a JWT-based grant format for agents operating across organisational boundaries. When Agent A in Company X needs to call a service in Company Y, ID-JAG provides the token format, the claims structure and the verification model. We cover the grant lifecycle, how scope attenuation works as the token crosses domains, and the trust anchor requirements. We compare it to federated OIDC and explain where ID-JAG fills gaps that federation does not.
49-04 Autonomous Agent Authorization (AAuth) 1 hr
AAuth proposes an authorization model where agents request permissions based on what they need to do, not who they are acting for. The authorization server evaluates the agent's identity, its declared intent and its trust history, then issues a scoped token. This is a different model from OAuth's "user grants access to client" pattern. We walk through the request flow, how intent declaration works, how the authorization server makes its decision, and the open questions around trust bootstrapping.
49-05 DPoP (Demonstrating Proof of Possession) 0.5 hr
DPoP binds a token to the specific key that requested it, so a stolen token is useless without the private key. For agents this matters because tokens travel through tool chains, message queues and delegation hops where interception is a real risk. We cover how DPoP works (the proof JWT, the thumbprint binding), how to implement it in agent flows, and why sender-constrained tokens are becoming a baseline expectation.
49-06 SPIFFE and Workload Identity 1 hr
SPIFFE gives every workload a cryptographic identity (an SVID) without shared secrets, passwords or API keys. For agents running in Kubernetes, VMs or serverless, SPIFFE provides identity at the infrastructure layer that the agent can present to any service. We cover SPIFFE IDs, JWT-SVIDs vs X.509-SVIDs, trust domains, trust bundles, JWKS endpoints and how SPIRE (the reference implementation) issues and rotates credentials automatically.
49-07 MCP Authorization 1 hr
The Model Context Protocol now includes an authorization layer for tool access. When an agent calls a tool through MCP, the server can require the agent to present credentials and prove it is authorized for that specific tool. We cover the MCP auth flow, how it integrates with OAuth 2.1, the resource indicators extension, and the practical gaps: what MCP authorization handles (tool-level access) and what it does not handle (agent identity, provenance, payment authorization).
49-08 Delegation, Scope Attenuation and Provenance 1 hr
Three problems that cut across every protocol. Delegation: how an agent proves who gave it authority and how much. Scope attenuation: how authority narrows as it passes through a chain of agents, so Agent C cannot do more than Agent B authorized, which cannot do more than Agent A authorized. Provenance: how a receiving system traces a request back through the chain to the original authority. We show how each protocol above addresses (or fails to address) each problem.
49-09 Revocation at Machine Speed 0.5 hr
Humans revoke access on HR timelines. Agents need revocation in seconds. We cover token lifetime strategies, real-time credential revocation, swarm-wide kill and the gap between what the specifications define and what actually works in production. Short-lived tokens, pushed revocation events and the tradeoff between revocation latency and verification cost.
49-10 Open Standards vs Vendor Branding 0.5 hr
The landscape is noisy. Some "protocols" are open specifications at IETF or OpenID Foundation with public review. Some are product features with a specification-shaped name. We teach you how to tell the difference: where to find the actual drafts, how to read their maturity level, what "adopted" vs "individual draft" means, and which ones to pilot now vs wait on vs avoid.
