Agent-Level Consent.
Agent-level consent is a user approving a specific, named AI agent, with specific scopes, rather than a generic app. The consent screen and the resulting token both identify the agent acting on the user's behalf.
Users increasingly run more than one agent, and an app-level grant cannot tell them apart. If a travel agent and a finance agent both run inside the same assistant, "this app may read your email" grants both. Agent-level consent makes the agent a first-class party in the grant, which is what lets a user see, scope and revoke each one.
It also gives the audit trail something to say. A token that carries the user, the client and the acting agent lets a resource server log who did what, and lets a support team answer "did I do this or did my agent?" Sources: draft-oauth-ai-agents-on-behalf-of-user-02, WorkOS on OAuth on-behalf-of for AI agents, and Scalekit on delegated agent access.
Our reading. You do not need the draft to adopt the idea. Store consent per agent identifier, show the agent's name on the consent screen, and use token exchange or an act claim to carry the agent in the token. That is the clean replacement for agent credential sharing. See consent management for the record-keeping side.
Common questions
What is agent-level consent?
Agent-level consent means the user approves a specific AI agent, named on the consent screen, for specific actions. Instead of "this app wants to read your email", the user sees which agent wants access, and the resulting token is bound to that agent, the client and the user.
What are requested_actor and actor_token?
They come from the IETF individual draft draft-oauth-ai-agents-on-behalf-of-user. requested_actor goes on the authorization request and identifies the agent the user is asked to approve. actor_token goes on the token request and proves the agent's identity; the authorization server checks it matches the approved agent before issuing a token.
Is the OAuth on-behalf-of draft for AI agents a standard?
No. The latest revision, -02, is dated August 25, 2025, and the IETF datatracker lists it as an expired individual draft that was not adopted by the OAuth working group. The pattern is used in products today, but the exact parameters may change.
How should a user revoke an agent's consent?
Revocation should target the agent's grant, not the user's whole session or password. A consent record per agent lets the user remove one agent while keeping others, and the authorization server should invalidate that agent's outstanding tokens at once.
Related terms
In the guides
Authorization Patterns for Agentic Workflows: Delegation, Constraints, and Just-in-Time Permissions
AI agents need authorization models that handle delegated permissions, multi-step workflows, and least-privilege at machine speed. The patterns that work and the ones being invented.
Consent Management Platforms (CMPs) and CIAM: Where the Lines Fall
How CMPs (OneTrust, TrustArc, Cookiebot) compose with CIAM. The architectural seam, when each handles what, and the integration patterns that work.
Token Management for AI Agents: Lifetimes, Rotation, and Revocation at Machine Speed
Agent tokens are stolen faster and used harder than human tokens. How to set lifetimes, rotate refresh tokens, scope per-tool, and detect anomalies in production agent deployments.