SECAI Core · phase 10 of 15
Open authorization
A standard for federated identity management, allowing resource servers or consumer sites to work with user accounts created and managed on a separate identity provider.
The Explain card
- Plain English
- Open authorization (OAuth) is a standard for federated identity management that lets a resource server or consumer site work with user accounts created and managed by a separate identity provider, without handling the user's password.
- Example
- A user connects an AI assistant to their cloud storage. OAuth redirects them to the storage provider to approve access, which issues the assistant a scoped token for reading specific folders. The assistant never sees the password and the user can revoke the token later.
- Why it matters
- AI agents increasingly act on behalf of users across services. OAuth scopes are where defenders enforce least privilege, and over-broad scopes are where breaches begin.
- Hook
- Valet key, not the master key.
Where it sits in the deck
Phase 10: Identity, Access, and Cryptographic Foundations
Before examining threats to systems, establish the foundational security primitives — identity, authentication, authorisation, and the cryptography underpinning them.
