OAuth for Agents: The Missing Permission Picture

Field notes

The explainer maps an agent task into a loop involving a user or system, the agent, a model, and external tools, services, or resources. Its seven scenarios add mechanisms incrementally, including an identity for an autonomous agent, delegation naming both user and agent, and contact with an unfamiliar MCP server. It also classifies the inference model as a protected resource and warns that any credential placed in its context can be exposed.