Agent Passports

Issue short‑lived Passports via OAuth Token Exchange (RFC 8693) with Rich Authorization Requests (RFC 9396). Bind to client with DPoP (RFC 9449) and use pairwise subject identifiers.

RAR example

{
  "authorization_details": [
    { "type": "tool", "actions": ["invoke"], "resource": "billing.export" }
  ]
}