The era where AI agents send emails and process payments on our behalf is approaching, yet security remains the biggest hurdle. Until now, the most common approach has been to hand over API keys issued to humans directly to agents, which is extremely dangerous as it effectively grants the agent full access to a user's account. If an agent gets stuck in an infinite loop or is compromised by malware, it could lead to a massive security incident. The OIDC4Agents and Agent Authorization Profile (AAP) standard drafts, currently being actively discussed by the IETF and the OpenID Foundation, are attempts to solve exactly this problem.

The core idea is to issue restricted, 'time-limited IDs' with only the necessary permissions, rather than giving agents full authority. For instance, the OIDC agent identity specification verifies identity by detailing which model is being used, its version, and who the agent provider is within the token. By adding OAuth AAP to this, it enforces server-level constraints on what tasks the token can be used for, as well as its expiration time and call limits. If an agent ever exhibits abnormal behavior, you can simply revoke the token assigned to that specific task without having to lock the entire account.

Particularly interesting is the COAZ specification, an AuthZEN draft approved by the OpenID Foundation last June. Instead of blindly allowing tool calls based on the popular Model Context Protocol (MCP), it filters requests by cross-referencing them against security policies in real-time, down to specific parameters, whenever an agent attempts to execute a particular tool. It seems this kind of cryptographic identity delegation will become essential infrastructure if agents are to evolve beyond simple software assistants into independent digital entities. haha