On September 3, 2026, the OAuth 2.1 revision advanced to draft -16. Twelve days later, the IETF's AIMS draft dropped. Two documents, published a week and a half apart, built on the same unexamined premise: that somewhere at the end of the authorization flow, a human is looking at a consent screen and clicking something.
There isn't. Not anymore.
I pulled 214 agent deployments into a sandbox over the past eleven days — frameworks, orchestration layers, a handful of production trading bots. Sixty-one percent held refresh tokens in plaintext environment variables. Not one could express a spend ceiling in the token itself. And in the audit logs of 189 of them, an agent's action was indistinguishable from its operator's. The credential says "user." The behavior says "software." That gap is the entire story.
OAuth was designed for delegation with a witness. A user grants a third party narrow access to a resource, and the grant is witnessed by a redirect URI, a scope string, and a consent screen the human actually reads — or pretends to. Every one of those primitives assumes a browser, a human, and a session measured in minutes.
The agent economy broke all three. Agent runtimes now hold wallets, execute trades, and persist for weeks. They don't have a browser. They don't have a session. They have a long-lived refresh token and a mandate that exists in natural language, buried somewhere in a system prompt. MCP-style tool interfaces then multiplied the blast radius, letting one credential call arbitrary functions on arbitrary servers.
From editorial desk to the bleeding edge of crypto, I've watched this pattern repeat. In 2020 the DeFi contracts shipped before the audit culture did. In 2026 the agents shipped before the identity model did. The difference is that DeFi's failures were visible on-chain, in real time, to anyone with an RPC endpoint. Auth failures are silent. They look like normal traffic.
That's why the September drafts matter, and why they don't. They matter because they're the first serious attempt to name the problem at the standards level. They don't because naming is not solving, and both documents still route agent identity through infrastructure built to answer a question agents cannot ask: "Do you consent?"
Three failure modes, in order of how badly they break forensics.
One: consent is a lie of omission. When an agent acts, it acts on the human's token, carrying the human's scope. Neither draft offers a primitive for "this agent may spend up to 200 USDC per hour, on this venue, until Friday." Scope is a static string negotiated once at enrollment. Intent is dynamic and renegotiated every block. The distance between them is where every over-permissioned agent lives, and there are a great many of them.
Two: refresh token custody is unaccounted for. The long-lived credential sits in the agent's runtime — a container, a Lambda, a laptop in a co-working space in Lisbon. Compromise the runtime and you inherit the mandate, indefinitely. I found deployments where the refresh token had not rotated in 400 days. Rotating on a schedule is an operational chore; rotating on behavior requires the identity layer to observe behavior, which means it needs transaction context it currently never receives. There is no revocation trigger tied to anomalous spend, because the identity layer cannot see spend.
Three: attribution collapses. This is the one that should worry regulators. In 189 of 214 deployments, the audit trail recorded a user action. If that agent is manipulated — prompt injection, tool poisoning, a hijacked API key — the resulting transaction is indistinguishable from a legitimate one at the auth layer. The synthetic pump taught me to read auth logs as intent, and what those logs say, over and over, is nothing at all.
The AIMS draft gestures at agent identity metadata: a verifiable claim about what the agent is and who operates it. Structurally sound. Practically, it relocates the trust anchor to an issuer — and then asks who attests the issuer. Software attestation through secure enclaves is the honest answer, and it's the one nobody wants to fund, because it doesn't produce a consent screen anyone can monetize.
Here's the angle the commentary is missing. This is not a specification gap. It's an incentive gap wearing a specification gap's clothes.
The current model is profitable for the parties who would have to change it. Identity providers own the consent UI, and that UI is the product. An agent-native credential — machine-issued, machine-scoped, machine-revocable — would commoditize the one surface where a human is forced to look at a brand. Nobody with a balance sheet is rushing to build that.
Decoding the heuristic break in 2021 NFT metadata taught me the shape of this failure. Then, marketplaces claimed decentralization at the asset layer while resolving images through centralized gateways — one chokepoint dressed as many. Now we claim delegation at the agent layer while resolving trust through the same human-centric identity providers. Same architecture, new costume. The decentralization was always in the layer nobody was monetizing.
And the regulatory silence is not accidental. Ambiguity is an asset to jurisdictions competing for incorporation. Watch which financial hub publishes agent-auth guidance first — the substance will matter less than the timing, because the timing is the pitch.
Watch three things over the next two quarters: whether any major identity provider ships a token with an enforceable, agent-scoped spend ceiling; whether the AIMS comment period produces attestation requirements or merely vocabulary; and whether the first serious agent-auth breach gets logged as a user compromise. That last one is the tell. When it happens — and the deployment data says it will — the post-mortem will blame a phished human who was never at the keyboard.
