EMILIA Protocol vs OAuth
OAuth authorizes sessions and scopes. EP authorizes a specific action with bound parameters. Both can coexist — and for any consequential workflow involving AI agents or high-value transactions, both are necessary.
The problem OAuth doesn't solve
A correctly issued OAuth access token with the payments:write scope authorizes any payment within scope until the token expires. The token has no opinion about the destination account, the amount, or whether the action that just executed matches what a human authorized.
For an AI agent that earned that token through a legitimate consent flow, a prompt-injected instruction to "wire $50,000 to a new beneficiary" is technically in-scope. The token authorizes it. The downstream system has no way to distinguish authorized action from compromised action.
EMILIA Protocol generates a one-time cryptographic handshake bound to the exact actor, the authority chain, the policy version, and the exact action context — destination, amount, beneficiary, every parameter — before the action proceeds. A captured handshake cannot be replayed against a different action. A compromised agent runtime cannot generate a valid signoff for an action that no named human approved.
Side by side
| Dimension | OAuth 2.1 / OIDC | EMILIA Protocol |
|---|---|---|
| Authorization granularity | Session + scope | Exact action parameters |
| Replay resistance | Refresh tokens, expiry | One-time consumable per action |
| Action parameter binding | No | Cryptographic — actor, authority, policy, action context |
| Named human signoff | Out of scope | Required for high-risk actions; bound to action context |
| Audit evidence | Token issuance / scope claims | Self-verifying trust receipt (offline verifiable) |
| Compliance mapping | OAuth 2.1, OIDC | NIST AI RMF, EU AI Act high-risk system controls |
| AI agent fit | Authorizes the agent runtime | Authorizes each consequential agent action |
When you need EP on top of OAuth
- An AI agent executes consequential actions on behalf of a human (payments, infrastructure changes, data exports, account modifications).
- The action is irreversible or high-cost to undo (wire transfers, benefit disbursements, production deploys, permission escalations).
- You need cryptographic evidence — beyond an audit log entry — that a named human approved this exact action with these exact parameters.
- Compliance frameworks (NIST AI RMF, EU AI Act, SOX) require pre-execution authorization controls, not post-hoc detection.
EP is not a replacement for OAuth. It is the layer that makes OAuth-issued sessions safe for the actions OAuth was never designed to authorize.