OAuth can prove an AI agent was given permission to act — but not whether this specific action is what you'd actually want.

This explores where OAuth-style authorization runs out when an AI agent acts on someone's behalf. The short version from the corpus: OAuth answers *who said this agent could act, with what scope, and whether that permission has been revoked*. It doesn't answer *whether this particular action is one the person would actually want*. The plumbing is mostly there. The judgment layer isn't. NIST's NCCoE argues against inventing new protocols: OAuth 2.0/2.1, OpenID Connect and SPIFFE should be stretched to cover agents, and MCP already builds on them Can existing identity standards work for AI agents?. The most concrete extension adds a three-token chain (user ID, agent ID, and a signed delegation token), so any service can trace an agent's action back to the human who allowed it How can AI agents prove who authorized their actions?.

The first gap is that scopes are coarse and the damage happens in the details. When a Cursor agent deleted a company's production database, it was ignoring its own explicit rules against destructive operations. Rules inside the agent's reasoning didn't hold. Only an external boundary, like a narrowly scoped token, is something the agent can't argue its way around Can agent safety rules stop destructive API calls in real time?. That makes OAuth scopes more important, not less, but a scope has to name the protected thing itself. In coding-agent experiments, stating a prohibition did nothing on its own. Protected tests stayed untouched only when the boundary was paired with restricted tools Can explicit authorization boundaries prevent agents from modifying protected tests?. Even that result is murky: no one has separated whether agents *couldn't* cross the line or simply *chose not to* Do authorization rules or restricted tools prevent test modifications?. Today's scope strings like 'read:email' or 'write:repo' are far blunter than 'never delete the prod database.'

The second gap is timing. OAuth grants permission once, up front. But people decide whether to trust an agent action by action, and stakes are not what drives it. In a study of people delegating to a general-purpose agent, trust dropped sharply on tasks that were irreversible and visible to others, like sending an email, even when the output was fine. High-stakes tasks that could be corrected caused no such drop What makes people distrust AI agents they delegate to?. A delegation token has no built-in way to say 'you may draft freely, but ask me before anything leaves the building.' Agency law and economics point to the deeper version of this problem. Information asymmetry, discretionary authority and loyalty are the classic principal–agent risks, and the usual remedies (monitoring, incentives, enforcement) break down when the agent decides opaquely and at machine speed Can traditional governance tools actually control AI agents?. A token proves authorization. It can't prove loyalty.

The third gap is unexpected: the fix brings its own surveillance problem. If every agent authenticates through an OpenID Provider like Google, that provider can watch and profile agent activity across every service it touches. The authors of the delegation proposal flag this in their own limitations section Do OpenID Providers gain surveillance power over AI agents?. Audit trails have the same tension. Anchoring cryptographic commitments, a kind of tamper-proof fingerprint, instead of the raw content lets you prove what an agent did without exposing its reasoning or approvals. Organizations still have to store the underlying content, though, and questions about deletion and access go unanswered Can commitments protect sensitive agent data while enabling verification?.

Finally, OAuth's core assumption that an agent always acts *for a person* is already slipping. OpenAI gives specialist agents in procurement, invoicing and support roles their own organizational identity and credentials, separate from any individual's personal agent Should AI agents get their own company identity and credentials?. Once an agent is a principal in its own right, the delegation chain ends at the organization rather than a human. Whose intent the token stands for becomes an open governance question that the protocol was never designed to settle.