Foundations

Auth51 isn’t a brand-new protocol. Almost all of it is ordinary OAuth and Zero-Trust machinery that’s already widely deployed, put together to work for autonomous agents. These pages cover that machinery first, then show where Auth51 builds on it.

You don’t need to read these to use Auth51. Read them if you want to know why it works the way it does, and what makes it different.

The intent–execution gap→
The single assumption OAuth 2.0 makes about clients, and why an autonomous agent breaks it. The problem everything else here answers.
OAuth 2.0 & JWT, quickly→
Grants, access tokens, bearer semantics, JWT and JWK. The machinery you already know, and where it stops being enough for agents.
Token exchange (RFC 8693)→
Trading one token for a narrower one, and the actor claim for “A acting for B.” The standard the agent_checksum grant is built on top of.
Proof-of-possession (DPoP & mTLS)→
Sender-constraining a token so a copy is inert. Why auth51 chose DPoP (RFC 9449) over mTLS, and binds per action rather than per session.
Zero-Trust alignment→
NIST SP 800-207 in one page: policy decision vs enforcement points, implicit trust zones, and how auth51’s components map onto them one-to-one.
The delegation landscape→
What GNAP, SPIFFE/SPIRE, cloud IAM, and actor chains each solve, and the agent-level, intent-bound gap none of them close.