[Web-bot-auth] Re: Interest in the human-principal layer above bot authentication

[Dick Hardt <[e-mail]>]

AAuth might be what you are looking for.

It builds on a similar http message signing primitive for agent identity as
WBA, and lets a resource request either identity and/or authorization,
using the same patterns as OpenID Connect and OAuth. We had an AAuth night
in SF last week during tha AI Engineering World's Fair and 160 people
attended and a number of independent vendors showed live demos of AAuth in
action.

https://datatracker.ietf.org/doc/draft-hardt-oauth-aauth-protocol/

https://aauth.dev

I have scheduled a side meeting for Thursday afternoon in Vienna.

/Dick



On Mon, Jul 6, 2026 at 9:45 AM Srecko Jovancevic <[e-mail]>
wrote:

> Blake, Songbo, all,
>
> Welcome, Blake. I'm following this mostly as an observer, so take
> this as observation rather than a position -- and I land where
> Songbo did: if a human-principal assurance is wanted, it belongs
> as a separate verifier-facing claim carried beside the request,
> never in the bot signing key.
>
> It may help the scope question to lay out where the existing
> mechanisms actually sit relative to a human principal, because the
> pattern is consistent -- almost none carry one, and mostly by
> design:
>
>   - Web Bot Auth / httpsig authenticates the automated client's
>     key, and Section 6.2 deliberately forbids tying that key to a
>     person. Human principal: excluded by design.
>
>   - SAIP identifies the agent at vendor/type/instance level; its
>     identity is the automation, not a human (no human
>     correlation). Same deliberate exclusion.
>
>   - The anonymous approaches -- Rescorla/Barnes ABA, and PACT --
>     remove identity entirely; a named human principal is the
>     opposite of what they provide.
>
>   - VDAC (my own) binds an agent and a site in a mutual contract.
>     That is accountable, but the parties are the agent and the
>     site, not a consent-bound human standing behind a single
>     request -- so it's adjacent, not this layer either.
>
>   - Songbo's verifier matrix is the one framework here with a slot
>     for it: a separate row (his human/org authority claim),
>     carried beside the request, verified under the origin's own
>     rules, failing independently of bot-key verification.
>
> So to your scope question directly: the human-principal layer
> looks out of scope for the signing key and for this group's core
> deliverable -- every agent-auth mechanism here keeps the human out
> of the key on purpose, and the anonymous ones remove identity
> altogether -- but it's a legitimate adjacent layer that a separate
> effort or a profile could carry, and it already has a clean shape
> in Songbo's row model. Wherever it lands, it would want to inherit
> this group's base posture: optional and default-off, so it never
> becomes a de facto human-identification gate.
>
> One distinction that may be worth making explicit, reading the
> drafts from the side: "human principal" is doing double duty.
> draft-morrison-consent-settlement carries the human as the data
> subject an attribute is about (consent plus settlement); the
> authority behind the agent -- the party on whose behalf it acts --
> is a different role, and as far as I can see none of the drafts,
> including the bilateral two-entity case in
> draft-morrison-identity-accord, squarely carries that one. If that
> reading is right, the scope question sharpens to: is there room for
> that authority claim, as an optional row beside the request?
>
> Best regards,
> Srecko
> ------------------------------
> *From:* Songbo Bu <[e-mail]>
> *Sent:* Monday, July 6, 2026 8:33 AM
> *To:* [e-mail] <[e-mail]>
> *Subject:* [Web-bot-auth] Re: Interest in the human-principal layer above
> bot authentication
>
> Hi Blake, all,
>
> I think the separation you describe is the right one: the Web Bot Auth
> signing key should remain the automated-client key, not a human key.
> If a deployment needs a human-principal assertion, I would model it as
> a separate verifier-facing claim carried alongside the request, or
> referenced from it, rather than as a change to the bot signing key.
>
> One way to keep the scope clean is to state it as a separate row:
>
> - Claim: a named, consented, or otherwise accountable human principal
> stands behind, approved, or is associated with this request under a
> stated grant or consent rule.
> - Carrier: a consent receipt, authorization receipt, signed grant, or
> external reference; not the Web Bot Auth signing key itself.
> - Verifier and rule: the origin or relying party verifies the
> human-principal artifact under its own issuer, key, and trust rules,
> separately from bot-key verification.
> - Binding and freshness: the human-principal artifact is bound to the
> request, origin, purpose, scope, time window, and, where applicable, a
> request or action digest.
> - Failure behavior: bot authentication can still succeed while the
> human-principal row fails; the application then treats the request as
> lacking that optional human-principal assurance.
>
> That keeps Web Bot Auth's base property intact while leaving room for
> profiles or companion work to define voluntary human-principal
> assertions. It also avoids implying that every bot request needs a
> human behind it, which would be the wrong default.
>
> I have been working on a protocol-neutral verifier-matrix draft for
> exactly this kind of separation:
>
> https://datatracker.ietf.org/doc/draft-bu-agentproto-security-principal-binding/
>
> The draft is not Web Bot Auth-specific, but its row model may be
> useful if this thread continues.
>
> Best,
> Songbo
>
>
> On Mon, 06 Jul 2026 01:55:18 +0000, Blake
> <blake=[e-mail]> wrote:
> > Hello,
> >
> > I have been following the working group's drafts and wanted to introduce
> > myself and where my own work sits, ahead of 126.
> >
> > My name is Blake Morrison and I have been building agent-identity
> > infrastructure. The part I keep running into is the layer your charter
> > sets aside - the verified human principal behind an agent.
> >
> > Web Bot Auth proves an automated client controls its key, and Section
> > 6.2 is clear that the signing key must not be tied to a person. That
> > seems right to me.
> >
> > My question is whether there is room alongside that for an optional and
> > consent-bound way for a verified human to voluntarily stand behind an
> > agent's request, for the cases where an origin wants more than "this is
> > a well-behaved bot". I am not proposing to put any of that into the key
> > or the signature; I am asking whether the group sees the human-principal
> > layer as in scope, deliberately out of scope, or something a separate
> > effort should carry.
> >
> > The most relevant of my submitted drafts is
> > draft-morrison-consent-settlement, which defines a scoped, revocable
> > consent grant the subject issues for reads of identity attributes. I
> > raise it only as background, not as a proposal here.
> > https://datatracker.ietf.org/doc/draft-morrison-consent-settlement/
> >
> > I am not asking for adoption or for agenda time; I would value the
> > group's view on the scope question, and pointers to anything in this
> > space I have missed. I am following 126 remotely from Australia and
> > would be glad to talk it through on the list or a call.
> >
> > Thank you,
> >
> > Blake Morrison
> > Alter Meridian Pty Ltd
> > [e-mail]
> >
> > _______________________________________________
> > Web-bot-auth mailing list -- [e-mail]
> > To unsubscribe send an email to [e-mail]
>
> _______________________________________________
> Web-bot-auth mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> _______________________________________________
> Web-bot-auth mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
>