OAuth 2.0 and Grantex Are Complementary

OAuth authorizes clients to access protected resources; Grantex adds a verifiable agent, principal, scope, and delegation context.

OAuth 2.0 is a widely deployed authorization framework. Grantex does not replace it. A product can use OAuth or OpenID Connect to sign in a person and authorize an application, then use Grantex when an AI agent inside that application acts for that principal.

Grantex is an open-source delegated authorization and trust layer for AI agents. It complements OAuth 2.0 and MCP by proving which agent may perform which action for which principal.

Different authorization boundaries

Question	OAuth 2.0	Grantex
Primary subject	Resource owner, client, and authorization server	Agent, human or organization principal, and receiving service
Application identity	OAuth client identifier	Works alongside the application's OAuth identity
Agent identity	Not a core OAuth role	Agent DID bound into the signed grant token
Delegation chain	Not defined by the core framework	Narrower child grants with parent and depth context
Verification	Token format and validation depend on the authorization server	Signed JWT claims verified with keys obtained from JWKS
Current revocation	Authorization-server policy, introspection, or short lifetimes	Central grant state plus online or synchronized enforcement
Action records	Implemented by the application or provider	Optional Grantex audit integration; not implied by token verification

A combined architecture

Authenticate the person through your existing identity provider.
Use OAuth for the application's access to the upstream service where that service supports OAuth.
Register the acting agent and obtain a Grantex grant with the narrow task scopes.
At your tool or API boundary, verify the grant token and enforce the exact scope.
Use the upstream OAuth token or backend credential only after the agent-specific decision succeeds.

What Grantex adds

A stable agent identifier and the principal on whose behalf it acts.
Attenuated multi-agent delegation instead of copying a parent credential.
A consistent grant-token shape for service-side agent authorization.
Optional audit records attributed to the agent, principal, and grant.

Standards status

The Grantex protocol specification is open and frozen at version 1.0. The related Delegated Agent Authorization Protocol (DAAP) document is an individual IETF Internet-Draft submitted for discussion; it is not an IETF standard, working-group adoption, endorsement, or certification.

Use OAuth for application and user authorization. Add Grantex where the receiving service also needs to verify the acting agent's delegated authority.

Design both layers explicitly

See the protocol flow, exact SDK versions, and verification boundary.

Read the specification Release status

Technical review updated 12 July 2026.