OAuth scopes and delegated permissions are related, but they are not the same thing. A scope is an authorization-server-defined label for access requested and granted to a client. Delegated permission describes the broader relationship in which a user or other resource owner authorizes an AI agent or client to act on their behalf. A scope can help express the access boundary; it does not, by itself, identify who authorized the agent, establish what resource it may reach, or prove that each request is properly enforced.
What is an OAuth scope?
In OAuth 2.0, the scope parameter indicates the access a client requests, and the authorization server may grant. RFC 6749 defines scope values as space-delimited, case-sensitive strings, but leaves their meanings to each authorization server. As a result, a scope label is not a universal permission name: the same-looking label can have different meanings across providers.
As an Amazon Associate I earn from qualifying purchases.
Requested access and granted access are not necessarily identical. The authorization server can ignore some requested scopes under its policy or the resource owner’s instructions. If the scope actually granted differs from what the client requested, the server reports the granted scope in the token response.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteAn access token is more than a descriptive list of labels. It represents authorized access with particular scopes and a duration, and the authorization server and resource server enforce it. The resource server must validate the token and ensure its authority covers the requested operation. See IETF RFC 6749.
What does delegated permission mean?
“Delegated permission” is a useful general description of authority that a principal—often a user—has authorized another actor to exercise on that principal’s behalf. It describes an authorization relationship and its policy context, not one universal OAuth 2.0 field or scope syntax.
OAuth distinguishes the resource owner, client, authorization server, and resource server. In an AI-agent system, the agent may act as or through a client. Understanding the delegation therefore means asking not only what access is allowed, but also who authorized which client or agent, for which resource and actions, and where those limits are checked.
How scopes and delegated permissions differ
| Question | OAuth scope | Delegated permission |
|---|---|---|
| What does it describe? | An authorization-server-defined value indicating requested or granted access. | The authority relationship in which one actor is allowed to act on another’s behalf. |
| Is it a universal OAuth term or syntax? | The scope parameter is standardized; the meanings of its values are defined by the authorization server. |
No single cross-vendor OAuth field or meaning; product interfaces may use the phrase in provider-specific ways. |
| Does it identify the user-agent relationship? | Not by itself. | That relationship is central to the concept, though the exact evidence and controls depend on the system. |
| Where is access enforced? | The authorization and resource servers enforce the token’s authority. | Delegation context does not replace the resource server’s checks on each request. |
In short, a scope can be one part of how delegated access is represented, but the terms are not interchangeable. The word “delegated permissions” can also have a specific meaning in an individual provider’s product; without naming a provider, it should be read as a general description rather than a vendor permission model.
Can an AI agent use OAuth on a user’s behalf?
Yes, an agent can act as or through an OAuth client in a system designed to let it use delegated access. For example, a user might authorize an agent to read selected calendar events. A provider could use a scope string to express a capability such as reading, but that label alone would not say which user authorized access or which agent is acting. A robust design also limits the token to the intended calendar resource and actions, identifies or binds the agent where appropriate, and requires the resource server to check each request. This is an illustrative design, not a claim about any provider’s actual scope names.
For an agent system, keep two questions distinct: what may the token do? and why does this agent have that authority? The first concerns the token’s permissions and enforcement; the second concerns the delegation path, consent, and identity evidence.
How to limit what an AI agent can access
Current OAuth security guidance favors least privilege and narrow, enforceable tokens. RFC 9700 says: “The privileges associated with an access token SHOULD be restricted to the minimum required for the particular application or use case.” Its recommendations include:
- Request only necessary privileges. Keep token authority to the minimum needed for the agent’s particular task.
- Restrict the audience. Issue tokens for the intended resource server, or a small set of resource servers; a resource server must reject tokens not meant for it.
- Constrain resources and actions. A scope may describe access at a useful level, while Rich Authorization Requests’
authorization_detailscan describe resources and/or actions in more detail. The resource server should enforce the relevant limits on each request. - Reduce bearer-token theft risk. RFC 9700 recommends sender-constraining access tokens, such as binding them to mutual TLS or using DPoP, so possession of a stolen token alone is less useful.
- Make the delegation legible. Capture appropriate consent and agent identity information, and retain audit data that explains the delegation path. Recording that path does not replace resource-server authorization checks.
- Choose a suitable token lifetime. Token duration is part of the authority represented by a token; set it to fit the task and risk rather than assuming a narrow scope alone is sufficient.
See the IETF OAuth 2.0 Security Best Current Practice, RFC 9700, and the Rich Authorization Requests specification for the related security and authorization mechanisms.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
How current AI-agent OAuth proposals handle delegation
Two IETF Internet-Drafts propose ways to make agent identity, human consent, and delegation more explicit. They are drafts, not finalized OAuth requirements or evidence of a universally deployed implementation; their content and status can change.
| Proposal | How it approaches delegation |
|---|---|
| On-Behalf-Of User Authorization for AI Agents, draft-02 | Proposes requested_actor in authorization requests to identify an agent and actor_token in token requests to authenticate it during an authorization-code exchange. It describes a flow that may begin with a resource-server challenge, explicit user consent, and token claims documenting a user-to-client-to-agent delegation chain. |
| OAuth Profile for Delegated AI Agent Authorization, draft-02 | Proposes agent OAuth client metadata, an authorization-code flow with authenticated human consent, resource-bound sender-constrained JWT access tokens, and attenuation of downstream delegation using OAuth Token Exchange. It does not claim that an AI agent is a legal person or require a new authorization framework. |
The approaches can be compared by examining when consent occurs, how the agent is identified, how tokens are bound to a resource and sender, how delegated authority can be narrowed downstream, and which claims support auditing. The IETF OAuth Working Group’s documents index lists related published specifications, including Token Exchange (RFC 8693), Rich Authorization Requests (RFC 9396), DPoP (RFC 9449), and RFC 9700.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
