As you roll out AI agents into your enterprise stack, it's tempting to assume that the security and governance controls built for humans and traditional services will simply carry over. Not so. OAuth gives us delegated access, but by itself it can't ensure that autonomous agents stay inside the guardrails.
The Gaps
Too much power, not enough context
Once an agent gets an OAuth token it can keep firing off API calls — often far beyond what
the user had in mind. Scopes like calendar.readwrite can't express intent like
"only book meetings on weekdays between 9–5."
Who actually pressed the button?
OAuth tokens tell you which user is behind a request, but not which agent (or sub-agent) made it. We need "actor" tokens that travel with each call for true accountability.
One-time consent vs. continuous decision-making
Humans can't approve every micro-action an always-on agent takes. We need real-time checks and step-up permissions — not a static "yes" at login.
Standing access vs. just-in-time access
Long-lived tokens give an agent perpetual power it may need only once a week. That "standing privilege" is a gift to attackers using prompt-injection and other techniques. Agents should instead request short-lived, task-scoped tokens on the fly and drop them when the job is done — zero standing privilege (ZSP) for agents.
OAuth 2.0/2.1 is a great starting point, but on its own it can't guarantee that AI agents stay inside the guardrails. What is needed is layered controls: task-scoped tokens, policy engines, and audit hooks to keep AI agents safe and aligned.
Working Paper
I've outlined the gaps and a proposed layered mitigation strategy in full below, and on TechRxiv. Feedback welcome!