List of new work that may be needed based on this draft

[PieterKas]

1. Human-in-the-loop - how to request users to grant additional authorization in an out-of-band manner.
2. Agent credential handling - Define architectures and patterns for agents using credentials at their disposal

[aeoess]

On #2, I think the first thing to pin down is that the credential never ends up somewhere the LLM can reach it. Yaron's framing in #127 seems right: the model is the part most exposed to prompt injection, so the secret stays in the infrastructure layer and out of the model context

The shape is a delegated grant the agent can present and narrow, signed with its own key, so it can prove what it is allowed to do without holding the underlying secret

Side note, out of scope here: once authorization is handled, there is still the question of what record survives after the agent acts. That is where audit and incident review usually land. I've been writing that layer up in IETF Internet-Draft draft-pidlisnyi-aps, if it is useful as a datapoint later