No international standard governs revoking an agent's authority (Global, absent); ISO/IEC 42001, AI management system (Global, verified); Mastercard Agent Pay (Global, reported, primary not reached); Visa Trusted Agent Protocol (Global, verified); SPIFFE workload identity (Global, verified); A2A protocol, agent to agent authentication (Global, verified); RFC 7591, OAuth 2.0 dynamic client registration (Global, verified); RFC 8693, OAuth 2.0 token exchange (Global, verified); RFC 9728, OAuth 2.0 protected resource metadata (Global, verified); RFC 8707, resource indicators for OAuth 2.0 (Global, verified); RFC 6749, the OAuth 2.0 authorization framework (Global, verified); MCP 2026-07-28 authorization hardening (Global, verified); Model Context Protocol authorization (Global, verified); NIST SP 800-63-4 Digital Identity Guidelines (United States, verified).

Standard or protocol

What is settled?

14 records of kind standard or protocol are on the Agent Authority Ledger as of September 2026: 12 verified, 1 reported, 0 announced, 1 absent, 0 open. By jurisdiction: United States 1, Global 13.

Standard or protocol

14 records, newest first

AbsentStandard or protocolAAL-2026-0030
No international standard governs revoking an agent's authority
Global · verified 15 September 2026
The Model Context Protocol relies on short lived access tokens and audience validation rather than on any revocation mechanism for an agent.
VerifiedStandard or protocolAAL-2026-0027
ISO/IEC 42001, AI management system
Global · verified 15 September 2026
The standard states that it specifies the requirements and provides guidance for establishing, implementing, maintaining and continually improving an AI management system.
Reported, primary not reachedStandard or protocolAAL-2026-0020
Mastercard Agent Pay
Global · verified 15 September 2026
A partner announcement states that Mastercard Agent Pay will integrate with PayPal's wallet to allow AI agents to simply and securely complete transactions on behalf of PayPal users.
VerifiedStandard or protocolAAL-2026-0019
Visa Trusted Agent Protocol
Global · verified 15 September 2026
Visa describes the specification as the official rulebook detailing the technical processes for recognizing a Visa approved agent, including the cryptographic standards in RFC 9421.
VerifiedStandard or protocolAAL-2026-0018
SPIFFE workload identity
Global · verified 15 September 2026
SPIFFE is described by its maintainers as a set of open source standards for securely identifying software systems in dynamic and heterogeneous environments.
VerifiedStandard or protocolAAL-2026-0017
A2A protocol, agent to agent authentication
Global · verified 15 September 2026
The documentation states that A2A protocol payloads, such as JSON-RPC messages, do not carry user or client identity information directly.
VerifiedStandard or protocolAAL-2026-0011
RFC 7591, OAuth 2.0 dynamic client registration
Global · verified 15 September 2026
The specification defines mechanisms for dynamically registering OAuth 2.0 clients with authorization servers.
VerifiedStandard or protocolAAL-2026-0010
RFC 8693, OAuth 2.0 token exchange
Global · verified 15 September 2026
The specification defines how to request and obtain security tokens from OAuth 2.0 authorization servers, including tokens employing impersonation and delegation.
VerifiedStandard or protocolAAL-2026-0009
RFC 9728, OAuth 2.0 protected resource metadata
Global · verified 15 September 2026
The specification defines a metadata format an OAuth client or authorization server can use to obtain the information needed to interact with a protected resource.
VerifiedStandard or protocolAAL-2026-0008
RFC 8707, resource indicators for OAuth 2.0
Global · verified 15 September 2026
The document defines request parameters that let a client signal to an authorization server the identity of the protected resources it is requesting access to.
VerifiedStandard or protocolAAL-2026-0007
RFC 6749, the OAuth 2.0 authorization framework
Global · verified 15 September 2026
The framework enables a third party application to obtain limited access to an HTTP service on behalf of a resource owner, or on its own behalf.
VerifiedStandard or protocolAAL-2026-0006
MCP 2026-07-28 authorization hardening
Global · verified 15 September 2026
The release post states that authorization servers should return the iss parameter per RFC 9207, and clients must validate it before redeeming a code.
VerifiedStandard or protocolAAL-2026-0004
Model Context Protocol authorization
Global · verified 15 September 2026
Authorization servers must implement OAuth 2.1 with appropriate security measures for both confidential and public clients.
VerifiedStandard or protocolAAL-2026-0003
NIST SP 800-63-4 Digital Identity Guidelines
United States · verified 15 September 2026
The guidelines apply to all online services for which some level of assurance in a digital identity is required, regardless of the constituency.

Every surface

Cut the ledger another way

By kind

By jurisdiction

Cite this page

Free to reuse under CC BY 4.0, with attribution.

In a sentence: According to the GAGE Agent Authority Ledger (as of 15 September 2026), standard or protocol: agent authority ledger.
APA: GAGE (Global Academy of Generative-AI Education). (2026). Standard or protocol: Agent Authority Ledger. Agent Authority Ledger. Retrieved 15 September 2026, from https://www.gage.academy/tools/agent-authority-ledger/kinds/standard
MLA: "Standard or protocol: Agent Authority Ledger." Agent Authority Ledger, GAGE (Global Academy of Generative-AI Education), 15 September 2026, https://www.gage.academy/tools/agent-authority-ledger/kinds/standard.
Chicago: GAGE (Global Academy of Generative-AI Education). "Standard or protocol: Agent Authority Ledger." Agent Authority Ledger. Last modified 15 September 2026. https://www.gage.academy/tools/agent-authority-ledger/kinds/standard.
Permalink: https://www.gage.academy/tools/agent-authority-ledger/kinds/standard

Last updated 15 September 2026. Every record re verified 15 September 2026. The ledger is checked weekly, every Monday, and the same day for any NIST, IETF or MCP publication.

Back to the full ledger and every standard or protocol record.

Credential program

Earn a verifiable agentic AI governance credential. The first module is free.

Documenting one agent's authority is the right instinct. Deciding what authority every agent in an organization gets, how it is bounded, logged and revoked, and who answers for it is the job.

Certified Agentic AI Governance Professional (CAAGP) is the program for governing agents that act: what authority an agent gets, how it is bounded, logged and revoked, who answers for it, and how to prove the design to an auditor. It ends in a credential an employer can verify.

12 modules, 100 topics, each with a lesson and a graded quiz.
Opens with “Welcome to Applied Conformance”, and the whole first module is free.
The Professor answers your questions inside every topic.
A mastery exam at the end, then a credential anyone you send it to can verify.
Your progress is saved to your account, on any device.

To start

Free

The first module, with a free account. No card is asked for.

Read the full description

Back to the ledger

GAGE briefings tell you which AI regulation deadlines are coming, what they actually require of you, and when a program opens.