IANA-AP
Intent Agent Native Authorization
for Agentic Profiles
Traditional authorization asks if a request is allowed. Agentic systems need to ask something more: does this request still belong to the plan you approved? IANA-AP is a runtime authorization framework for AI agents. Before any tool runs, the agent discovers what authorization is required, computes its intent, and surfaces the full plan for review. You approve it inline with a Passkey, one cryptographic gesture that binds every action to the declared scope. If a call falls outside the approved intent, it does not execute.
The Framework
IANA-AP
Intent Agent Native Authorization for Agentic Profiles is a runtime authorization framework that composes OAuth 2.0, OpenID AuthZEN, WebAuthn/FIDO2 Passkeys, and MCP, plus TwoGenIdentity agentic frameworks, rather than replacing them. Unlike deterministic software, an agent only discovers what authorization it needs once it understands the request. IANA-AP closes that gap: the agent declares its full plan, the user reviews and approves it with a single Passkey gesture, and a cryptographically bound token is issued. Every subsequent tool call is verified against that signed intent. Agents earn the right to act. They do not assume it.
How It Works
The Four Phases of IANA-AP
IANA-AP replaces implicit trust with a strict authorization lifecycle. Every agent action passes through four phases, from discovering what's required to enforcing it at runtime, each one a verifiable cryptographic boundary.
Discover Required Authorization
The agent reads the service's Agentic Profile, a machine-readable definition that declares what authorization each tool requires.
Compute Authorization Intent
Using the discovered requirements and the user's prompt, the agent works out its planned operations and assembles them into a proposed intent.
Review and Approve
The full plan is surfaced natively inside the agent interface, no browser redirect. The user approves with a single phishing-resistant Passkey gesture.
Runtime Enforcement
Every tool call is intercepted and checked against the approved intent before it runs. Anything outside the signed scope is blocked.
See It In Practice
Inside an Intent Agent Native Authorization Review
This is what the agent surfaces before it acts: the full plan, waiting on your Passkey. Nothing executes until you approve it. Here's what happens in each phase along the way.
Discover Required Authorization
Reads the Agentic Profile
Before doing anything, the agent reads the service's Agentic Profile via the MCP Server Card or tools/list response.
Only tools that opt in are pre-authorized
Each tool declares participation with an authorization mapping. Tools without one fall back to just-in-time approval instead.
Supported Agentic Profile Targets
Authorization Mapping in Agentic MCP Profile
Each tool opts in to IANA-AP with an x-authz-mapping that declares the authorization required to invoke it.
Compute Authorization Intent
Matches your prompt to what's needed
The agent maps your prompt against the mappings discovered in Phase 1 to work out exactly which actions, on which resources, are required.
Can plan, but can't act
This phase can run as a dedicated Intent Agent: a constrained component that computes the plan but has no ability to invoke tools.
Produces the agent_intent claim
Each planned tool call becomes one agent_intent entry, a structured claim the user will review and approve as a set in the next phase.
The SARC Model
Subject
Action
Resource
Context
Worked example, same plan shown in Phase 3:
Subject
alice, from the token
Action
tools/call
Resource
mcp-tool: disable_user
Context
the agent's identity
Review and Approve
Discovered and computed before you see it
By the time this card appears, the agent has already read what's required and worked out exactly what it needs to do.
Nothing runs until you approve
The full plan sits here, visible end to end. You can inspect every action before deciding.
One Passkey tap, every action covered
A single gesture approves the whole plan, not one prompt per action.
You can approve some, deny others
Approval isn't all-or-nothing. The Authorization Server can approve individual actions and deny the rest; the agent may only invoke tools whose entry was actually approved.
Execution Plan
3 actions awaiting your approval:
Awaiting Passkey approval to bind this plan
One gesture approves all 3 actions · nothing executes until then
Runtime Enforcement
Enforced exactly as approved
Once you tap, only these actions can run. Anything outside the plan is blocked at runtime.
No silent scope creep
Every call is checked against the signed plan again, every time. Approval never quietly expands.
The same SARC fields work with any PDP
Whether the decision is made remotely via AuthZEN or locally with Cedar or OPA, the enforcement point extracts identical Subject/Action/Resource/Context fields. Only the evaluation mechanism changes.
Policy Decision Point: Remote or Local
Remote PDP
OpenID AuthZEN
Local PDP
Cedar or OPA
Enforced at Every Stage of the Journey
Put It All Together
The Full Communication Sequence
The four phases above happen as one round trip. Here's how a single request travels from prompt to result. Tap a step to see the detail.
"Disable this user and export the audit log."
Authorization Mapping in Agentic MCP Profile
{
"name": "disable_user",
"_meta": {
"x-authz-mapping": {
"action": { "name": "params.method" },
"resource": { "type": "'mcp-tool'", "id": "params.name" },
"arguments": { "userId": "params.arguments.userId" }
}
}
}The agent_intent Entry
uses: Agentic Profile{
"type": "agent_intent",
"action": { "name": "tools/call" },
"resource": {
"type": "mcp-tool",
"id": "disable_user",
"properties": { "arguments": { "userId": "alice" } }
}
}Live Demo
See IANA-AP in Action
Full end-to-end demo of an agent orchestrator with A2A, MCP, and MCP Apps. The agent discovers what's required, computes and surfaces its plan, the user approves it with a Passkey, and every call is cryptographically verified against the signed intent.
IANA-AP: Full Demo
Composable Authorization
Combine Authorization Layers for Your Security Posture
Each authorization layer is independent and composable, like Lego blocks. Activate the layers that match the risk level of the operation. You are not locked into a single model. And within IANA-AP itself, no redesign is required: it works with the Authorization Server and policy engine you already run.
OAuth Security
Standard access control via OAuth and OpenID Connect. The baseline for every agent operation.
Intent Agent Native Authorization for Agentic Profiles
Pre-approve the full execution plan. Every action is cryptographically bound to the declared scope before the agent runs.
Just-In-Time Agent Native Authorization
Runtime step-up authorization for sensitive actions, backed by Passkeys and Human-in-the-Loop.
Why IANA-AP
A security-first approach to agentic execution. The question isn't just whether a request is allowed, it's whether it still belongs to the plan you approved. Agents earn the right to act. They do not assume it.
Plan Before Execute
The agent cannot act until the full execution plan has been reviewed and explicitly approved. No silent or implicit actions.
Scope-Bound Cryptographic Proof
Every action is verified against a signed intent token. Anything outside the approved scope is blocked before execution.
Checked Again at Runtime
If the agent's call doesn't match what was approved down to the resource and its arguments, it's rejected, even mid-session.
Passkey-Backed Approval
A Passkey gesture approves all planned actions, phishing-resistant, non-replayable, and tied to the user's registered identity.
No Browser Redirect
Intent review and Passkey approval happen inline inside any AI assistant or CLI agent. No context switch, no friction.
Built on Open Standards
Built on open standards and TwoGenIdentity agentic frameworks. Interoperable, portable, and free from vendor lock-in.
Composable by Design
Layer Intent Authorization on top of OAuth Security or combine it with Just-In-Time Authorization. Each layer is independent. Activate what your security posture requires.
Explore the Full Platform
IANA-AP is part of the TwoGenIdentity composable authorization stack. Explore the ANA framework for Just-In-Time runtime authorization, the IA+ IAM Platform that powers both, and the AuthZEN MCP Gateway that enforces policy at every agent request.