Rich Authorization Requests extend OAuth with an authorization_details parameter carrying structured, fine-grained authorization data instead of a flat list of scope strings. A request can express what may be done, to which resource, up to what limit, rather than approximating it with a scope name.
Rich Authorization Requests (RAR)
Rich Authorization Requests (RAR) (RFC 9396) — Rich Authorization Requests extend OAuth with an authorization_details parameter carrying structured, fine-grained authorization data instead of a flat list of scope strings. A request can express what may be done, to which resource, up to what limit, rather than approximating it with a scope name.
- Structured, not string-matched - JSON objects with a type and type-specific fields, instead of space-delimited scopes.
- Built for high-value transactions - Emerged from open banking, where ‘payment of £40 to this payee’ is not expressible as a scope.
- Constraint-carrying - Amounts, recipients, resource identifiers and conditions travel with the grant.
- The natural fit for agent intent - Exactly the shape an agent’s bounded permission needs to take.
RAR is the closest thing the standards world has to an answer for agentic authorization: an agent may refill inventory up to this limit, for this account, under these conditions. The OAuth 2.0 Standard finds it, DPoP and token exchange all specified and all effectively absent from published contracts — the specifications are ahead of the practice, and the practice does not change until something makes it expensive.
Referenced in API Evangelist papers
This standard shows up in my published research. These reports read the machine-readable evidence provider by provider — and put this standard in the context of a real sector.
The OpenID Connect Standard
Expresses intent rather than a scope string; the closest specified answer to what an agent may do.
The OAuth 2.0 Standard
Fine-grained, constraint-carrying authorization — the shape an agent's bounded permission needs, and absent from the corpus.
