Authentication Standards for AI Agents

Delegating a task to an AI agent — “check my account balance,” “update my subscription” — creates an authentication problem that password-based login was never designed for. Handing an agent a raw password means handing it unscoped, unrevoked, permanent access to everything that credential protects. That’s both a security risk and, for most real services, explicitly against the terms of service.

The fix the web already built for this is OAuth 2.0: a human authorizes a specific, scoped, revocable grant of access, and the agent receives a token — never the underlying credential. The missing piece for agents is discovery: an agent needs to find your OAuth endpoints programmatically, not read about them in a developer portal a human has to visit first.

The AX Audit checks for these, each contributing partial credit toward the full 10 points:

A real, conformant /.well-known/openid-configuration response is enough on its own to tell an agent everything it needs:

{
  "issuer": "https://auth.example.com",
  "authorization_endpoint": "https://auth.example.com/oauth/authorize",
  "token_endpoint": "https://auth.example.com/oauth/token",
  "jwks_uri": "https://auth.example.com/.well-known/jwks.json",
  "scopes_supported": ["read:account", "write:subscription"],
  "grant_types_supported": ["authorization_code", "refresh_token"],
  "code_challenge_methods_supported": ["S256"]
}

An agent reads this once, learns every endpoint and supported scope it needs, and never has to guess a URL or parse a developer-docs page to complete an authorization flow.

A separate signal this check also credits: /.well-known/content-signal.json, which declares a site’s policy toward AI systems explicitly — whether content may be used for search indexing, as input to an AI-generated answer, or for model training.

{
  "version": "1.0",
  "site": "https://example.com",
  "signals": {
    "search": "allow",
    "ai-input": "allow",
    "ai-train": "deny"
  }
}

robots.txt tells crawlers where they can go. content-signal.json tells agents and AI systems what they can dowith what they find — a distinction robots.txt alone was never designed to make.

Authentication Standards falls under AR-AUTH, the category covering delegated access — an agent operating under a human’s authorization rather than its own identity. In the live AX Audit, it’s its own named check worth up to 10 of the 100 points, the joint-highest single-check value alongside Agent Discoverability.

ainative.ax currently scores 5 of 10: it publishes content-signal.jsonbut doesn’t yet expose discoverable OAuth/OIDC endpoints, since its own API is free and unauthenticated by design. A site like vercel.com, which exposes all four OAuth signals, scores the full 10.