AAuth shows why agent identity needs native approval controls

At a glance

What this is: AAuth is a draft authentication and authorization protocol for AI agents that ties verifiable agent identity, delegated access and optional human approval into one flow.

Why it matters: It matters because IAM teams cannot govern agentic workloads with human-era approval models alone; they need controls that decide at issuance time, not after access has already been granted.

Context

AI agent authorization is the problem space here. Traditional OAuth and OIDC patterns assume a human or service principal with relatively stable intent, but agentic workloads can request, combine and exercise access dynamically at runtime.

AAuth is the article’s example of a different model: a protocol that tries to make agent identity explicit, preserve delegated access transparency and let human approval gate sensitive issuance. The central question for IAM teams is not whether approval is useful, but where in the flow it can still change the outcome.

This is an agentic AI governance issue rather than a general application-security problem. The article is discussing identity, delegation and human approval for autonomous-seeming software actions, which means the control point moves closer to authorization and away from simple authentication.

Key questions

Q: What breaks when AI agent approval is added too late in the authorization flow?

A: Approval added after credentials are issued no longer controls access, it only records that access happened. For AI agents, that means the system has already delegated power before a human can intervene. The result is overpermissive execution, weak accountability and review fatigue because operators are evaluating events that cannot be prevented.

Q: What is the difference between delegated context and authentication for AI agents?

A: Authentication proves the agent is the identity it claims to be. Delegated context preserves the human, service or workflow that initiated the request and bounds what the agent may do on that principal’s behalf. Without delegation, the agent may authenticate correctly but still operate with the wrong scope or no traceable origin.

Q: What signals show that human-in-the-loop review is failing for AI agents?

A: The main signals are repetitive approvals, reviewers rubber-stamping requests, unclear action scope and frequent escalation of routine tasks. Those patterns mean the approval step has stopped adding judgment and has become noise. At that point, the policy boundary is too broad and the control is no longer effective.

Q: When should organisations require human approval for an AI agent action?

A: Require human approval when the action could change infrastructure, expose sensitive data, move laterally across systems, or trigger a business-critical workflow that is hard to reverse. Approval is also warranted when the agent’s decision depends on ambiguous input or external data that cannot be trusted at face value. High-consequence actions need a human stop point.

Technical breakdown

How AAuth binds agent identity to delegated access

AAuth combines an agent’s own identity with the identity of the person or user it acts for. In practice, that means a resource can tell who the agent is, who authorised the delegation and what scope was requested, rather than seeing only a bearer token. The article describes public-private key credentials, discoverable public keys, JWT-based claims and scopes as the building blocks. That pattern matters because it makes the delegation chain visible enough to enforce policy at the point of access, not just at sign-in.

Practical implication: model agent identities separately from user identities and require delegation context in every authorization decision.

Why human approval belongs in the authorization flow

The article’s core mechanism is that the agent does not receive the needed credentials until approval is granted. That turns human-in-the-loop from a monitoring layer into a gating control. The advantage is not oversight for its own sake, but the ability to stop high-risk actions such as privileged access, production changes or bulk data operations before credentials are issued. This is a different control model from after-the-fact review, because once a token exists, the system has already delegated power.

Practical implication: place approval before token issuance for actions that are hard to reverse or likely to exceed normal scope.

Why OAuth and OIDC are not enough for agentic workloads

OAuth and OIDC were built to separate authentication from authorization for human and application contexts, but the article argues they do not natively express AI agent behaviour. The gap is not simply missing fields in a token. It is that agentic workloads need identity, delegation and approval to stay coupled while the actor is deciding and acting at runtime. Reusing JWTs, scopes and auth tokens can help, but only if the authorization model also tracks that the actor is an agent and not a conventional client.

Practical implication: do not assume legacy federation patterns are sufficient just because they can carry agent claims.

NHI Mgmt Group analysis

Approval has to move from oversight to issuance control. The article shows why “keep humans in the loop” becomes fragile when applied as a monitoring habit instead of an authorization constraint. If an AI agent can already obtain credentials before review, the human is no longer approving access, only observing it. For practitioners, the meaningful control boundary is whether the token exists at all.

Native agent approval is an identity governance problem, not a user-experience problem. AAuth is interesting because it treats agent identity, delegated access and human approval as one governance flow. That is the right framing for agentic AI, where the question is who may act, under what delegated authority and at what point the action becomes authorized. The implication is that IAM teams must govern issuance semantics, not just authentication strength.

Scope ambiguity is the real trust failure. The article makes clear that human approval fatigue comes from repeated review of actions whose risk context is poorly bounded. When an agent’s delegated scope is unclear, operators either over-approve or block everything. That tension is exactly why agent identity needs explicit policy context and why approval should be reserved for actions that materially change risk.

Delegation visibility: AAuth’s most valuable idea is that the resource should know both the acting agent and the human on whose behalf it is operating. That breaks with older patterns where authorization often sees only a token bearer. For identity programmes, this is the difference between generic access control and auditable delegated authority.

Human approval should be adaptive, not universal. The article correctly warns that repetitive review destroys signal quality. That means governance for agents should focus on high-consequence, hard-to-reverse or out-of-scope actions, while lower-risk requests stay automated. For practitioners, the objective is to preserve human judgment where it changes outcomes, not to route every agent action through a person.

From our research library:

• Half of companies using generative AI will deploy agentic AI by 2027, according to Deloitte's 2025 Technology Predictions.
• Read next: AI Agent Authorisation Guide

What this signals

Governance for AI agents is shifting from whether a request is authenticated to whether a request should be allowed to produce credentials at all. That is a material change for identity programmes because it moves the control point from session oversight to issuance-time decisioning.

Delegation visibility: this topic shows why agent identity and on-behalf-of context must remain attached through the full authorization path. Without that lineage, reviewers cannot tell whether they are governing an agent, a user or a delegated combination of both.

According to the 2026 Infrastructure Identity Survey, 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege. That gap makes approval design a governance issue, not an optional workflow refinement.

For practitioners

• Define approval thresholds by action risk Classify agent requests by reversibility, privilege level and blast radius so that only the right actions require human review before issuance.
• Separate agent identity from user identity Ensure delegated access records both the agent’s identity and the human it acts for, so policy can distinguish machine intent from user intent.
• Move controls to token issuance time Require approval before auth tokens are minted for sensitive actions, rather than relying on logs or post-execution review.
• Limit approval to high-consequence workflows Reserve human checkpoints for privileged access, production changes and bulk data operations where mistakes are hard to undo.
• Track approval fatigue as a governance signal Watch for repeated low-value approvals, because that usually means the policy boundary is too broad and reviewers are being trained to ignore prompts.

Key takeaways

• AI agent approval becomes meaningful only when it is built into credential issuance, not bolted on after access already exists.
• The article’s core evidence is that OAuth and OIDC alone do not express delegated agent identity well enough for high-risk automation.
• Practitioners should treat human approval as a targeted control for privileged, irreversible or out-of-scope actions, not a blanket requirement.

Key terms

• Agent Identity: An agent identity is the set of attributes, credentials and permissions assigned to an autonomous software entity. It is treated as a non-human identity because it can authenticate, act on systems and accumulate access over time, which creates governance, audit and lifecycle obligations similar to other production identities.
• Human-in-the-Loop Approval: A review step where a person explicitly approves a high-risk access request before it is granted. It is most useful for exceptional privilege expansion, not for routine automation, because the goal is to catch unusual requests without turning every machine action into a manual process.
• Delegated Access: Delegated access is permission granted to one identity to act on behalf of another user, service, or system. In NHI environments, this usually appears in OAuth-connected apps and automation tooling. It is powerful, but it must be tightly scoped and reviewed because it can persist long after the original business need ends.
• Approval Fatigue: The point at which repeated approval requests cause users to stop evaluating each one carefully. In agent governance, this is a control failure mode because the human reviewer becomes desensitised, making the oversight layer ineffective even though the workflow still appears compliant.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.