An automated agent hits your service. You have milliseconds to decide whether to act on it, and here is the sum total of what you're holding.
An account. An access token carrying scopes, which is just a list of doors somebody unlocked for this caller. And increasingly, some idea of whose software is on the line, because a growing share of agent traffic now shows up cryptographically signed. The Web Bot Auth work at the IETF, the body where internet protocols get argued into shape, spells out what those signatures carry: which parts of the request got signed, a key identifier, a creation time, an expiry, a nonce so nobody replays it, a protocol tag, and optionally a pointer to where you can go fetch the signer's keys and operator details.
That's good engineering. I mean that. It is also, per the specification's own words, not authorization. It proves a particular key signed a particular request aimed at your host before a particular moment, and it says nothing whatsoever about consent or delegation.
What you never learn is the errand.
Not what the agent was sent to do, or what it was told never to touch. No ceiling on what it can spend or change. Nothing about whether the human's grant of authority dies in five minutes or runs all quarter, or whether that authority can be handed onward to a second agent you will never see or hear about. Sit with the asymmetry for a second. The signature has an expiry. The mandate doesn't even have a field.
The part people wave off is the part that should scare them: you can't go back and recover it from logs either. Two completely different mandates produce byte-identical requests. A run authorized to update one customer record and a run authorized to update every customer record look exactly the same when only one record gets updated. There is no forensic move available. The information was never in the stream.
Scope won't dig you out, and was never built to. A later OAuth extension describes the classic scope mechanism as expressing "the limited capability, of an access token" and says flatly that it's fine for coarse, static access like reading a profile and insufficient for transaction-specific authorization. That whole specification, Rich Authorization Requests, exists because scope is too blunt for anything you'd actually care about.
Counterevidence now, because I'd rather argue the strong version. Scope strings mean whatever the issuing system says they mean, so any single deployment can absolutely stuff purpose into one. Rich Authorization Requests can already carry structured detail to the service that has to enforce it. So nobody is claiming this is impossible. What's missing is portability. There is no representation of a mandate that a service with zero prior relationship to that agent can read and interpret the same way everybody else reads and interprets it.
The sheer volume of attempts tells you how sharply the absence is felt. A survey presented to IETF participants in May 2026 counted 32 individual proposals on agent authorization. Three of them had independently grabbed the same acronym. And they cannot agree on the most elementary question in the whole design: where the errand gets delivered.
- To the system that issues tokens, which validates the stated intent and mints narrower credentials off it.
- Inside the token itself.
- Or straight at the receiving API in a header, as a signed delegation object with limits and a maximum delegation depth.
That middle option, intent carried in the token, expired unadopted on July 4, 2026.
Meanwhile purpose is getting reconstructed sideways, from the outside, by people who gave up waiting. Cloudflare now sorts automated traffic into categories including Search, Agent, and Training, with a policy default for new domains landing September 15, 2026. But that purpose is inferred by a classifier watching behavior. Nobody declared it. Visa's agent protocol runs the other way and has agents sign a coarse purpose tag the merchant can verify: browsing versus paying. Two values. Useful, and nowhere in the neighborhood of a mandate.
So here's the design problem nobody has cracked, and the reason is fucking maddening because it isn't technical. Nearly every signal being built for agent traffic exists to raise the recipient's confidence. Verified operator. Trusted agent. Registered directory entry. Telling a stranger where your authority stops does the opposite, handing them a fresh reason to hesitate before they act on you. Voluntary self-limitation is not something anybody ships alone. It works when it's expected, standard, and so cheap that leaving it out is what looks weird.
The claim still waiting on a replacement is the old one, the boring one: somebody is answerable afterward. A signal that restored it would need four properties.
- Cheap to send.
- Expensive to fake.
- Legible to a party with no prior relationship.
- Readable before reliance, not after dispute.
We shipped identity. We're treating it as sufficient.