Control Plane by Karl McGuinness

The question worth asking about AAuth is not only whether the protocol is good.

Agent runtimes naturally create the first trustworthy evidence about an instance, which gives them the default position in agent identity.

Agent task authority is scattered across four de facto records: harness permission prompts, OAuth grants, IAM roles, and change tickets.

The control-points series argues that distribution determines defaults and standard seams determine whether those defaults remain contestable.

Cross App Access is not twenty-five generally available integrations.

Long-running agents discover mid-task that they need a destination their egress proxy does not allow, and the block comes back as an opaque connection failure with no machine-actionable way to ask for access and no human standing by.

Model routers and customer-controlled agent state are now concrete product architectures, but they do not make every model interchangeable or every memory store strategic.

Delegated work forces four separate continuity questions: request provenance, identity attribution, target-applicable authority, and continuing work justification.

The enterprise agent control stack is not one product or one call chain.

Continuity Is Not One Thing argues that delegated work poses four independently governed continuity questions.

The least-privilege MCP series ends on a gap: token-side and resource-side authorization both work per call, and neither names the task the user approved.

Least privilege scopes what an agent may do, one tool call at a time.

Authorization looks the way it does because each generation solved the question its era made urgent, and deferred one question that someone else was always carrying: what approved work is this, and is it still on?

A handbook that ends on its own argument has not concluded, it has just stopped.

An architecture that only answers its own questions is untested.

Designing Mission-Bound Authorization establishes the architecture: the object, the laws, the framework, and the staged adoption path.

The AI agent auth best-practices draft names the Mission and declares its translation into authorization out of scope.

Enterprises already run a mature delegated-authority architecture.

The whole handbook on one page, in reading order: the cover, the five chapters, the companions, and the six appendices.

Re-subjecting across a SaaS boundary is a mint, not an attenuation, so the IdP must issue each onward grant.

Self-service agent sign-up exposes a first-contact trust problem: a Resource Authorization Server can verify a perfectly valid JWT and still not know whether the issuer is allowed to assert identities for the user’s domain.

Part one laid out two ways to lock down a single tool call an agent makes through the Model Context Protocol: carry a narrow token, or let the resource decide each call.

There are two natural ways to lock an agent’s Model Context Protocol (MCP) tool calls down to least privilege.

Microsoft’s ASSERT compiles written behavior requirements into executable evaluations: intent made executable for verification.

In Cross-App Access, a single signed-in user’s identity has to cross applications that each name them under a different subject.

Closed-world authorization treated denial as the end of the interaction.

OpenID Connect is mature, standardized, and widely deployed, but SAML remains the enterprise SSO default because it is familiar, explicit, and deeply embedded in procurement and operations.

WorkOS auth.md is an agent-readable registration document for one-click setup, with Agent Verified, user-claimed, and anonymous paths.

Modern agent harnesses make work durable across restarts, devices, background jobs, and sub-agents.

Client instances are not new clients.

Enterprise SaaS still defaults to app-by-app OAuth islands with their own clients, long-lived artifacts, and revocation paths.

The new version of AAuth (draft-hardt-aauth-protocol-01, since resubmitted as draft-hardt-oauth-aauth-protocol) materially changes the earlier comparison.

ID-JAG, also often called Cross-App Access (XAA), is centered in the current draft on Enterprise IdP trust, but the issuer that matters is the immediate IdP the downstream authorization server already trusts for SSO and subject resolution, not necessarily…

Open-world OAuth can improve discovery, resource binding, and first-contact trust.

OAuth was built for closed worlds, and that constraint is why it became mature.

The current split between token exchange semantics and JWT access token practice creates avoidable interoperability failures.

Part 2 turns from the semantic problem to the runtime one.

This essay picks up from Part 4 of the Mission-Bound OAuth series and focuses on the first hard problem: how approved intent becomes a governable Mission.

Mission-Bound OAuth is a serious attempt to govern delegated agent authority using existing OAuth infrastructure.

Mission-Bound OAuth argues for a durable Mission object that governs delegated authority across approval, lifecycle, delegation, and termination.

Rich Authorization Requests are the natural first instinct for agent missions, but audience-bound access tokens and uneven cross-domain interoperability limit how far they can carry a governed task.

OAuth answers whether a request is permitted right now.

An Execution Mandate defines what delegated authority looks like.

Tokens, credentials, and scopes tell a system what an agent may do.

Enterprise IAM was designed for human-paced execution.

Karl McGuinness Previously SVP & Chief Product Architect @ Okta Standards IETF OAuth WG · OpenID Foundation Focus Identity strategy, product architecture, agent-native world Currently Advising identity startups I’m Karl McGuinness, a product and technology

Identity is getting weird again, and in a good way.