OAuth 2.0
OAuth 2.0 is the industry-standard authorization framework that enables applications to obtain limited access to user accounts on third-party services. It works by delegating user authentication to the service that hosts the account and authorizing third-party applications to access that account on the user's behalf.
Why It Matters
OAuth 2.0 is the backbone of app-to-app authorization on the modern web. When you click "Sign in with Google" or authorize a third-party app to access your GitHub repositories, OAuth handles the token exchange.
In agent governance, OAuth plays two roles. First, it is the mechanism by which users grant agents access to their accounts on third-party apps. When an agent connects to Slack on behalf of a user, an OAuth flow issues a scoped token. Second, OAuth is the foundation that protocols like XAA extend for agent-specific authorization.
For governance teams, the key concern is token scope and lifetime. An OAuth token with broad scopes that persists indefinitely is a standing permission. Token rotation, scope limitation, and session-scoped token issuance bring OAuth usage closer to zero-standing-permission principles.