Why Consent Screens Fail for AI-Agent Authorization

Consent screens work when a person grants a stable application a recognizable class of access. They fail when an agent performs hundreds of context-dependent actions whose risk depends on tool arguments, data provenance, and the combination of capabilities available in one session.

The answer is not a better dialog. It is a different authorization model: policy handles routine actions, high-impact actions pause for an attributable prerequisite, and the agent receives a safe way to wait and resume.

OAuth consent was designed for applications

A useful OAuth screen can tell a user that a calendar application wants to read events. The grant persists because the application’s purpose and permission shape are stable enough to understand.

An agent chooses tools at runtime. Risk can turn on one argument:

send_message(channel="#finance", text="draft summary")

is not equivalent to:

send_message(channel="external-webhook", text=<customer records>)

Both may fit messages.write. A scope-level consent screen cannot express the difference.

Prompting on every action creates a rubber stamp

The obvious response is to confirm every tool call. That moves the decision to a person but does not make the person informed.

Approval quality falls as frequency rises. Tool names and generated explanations can hide the dangerous part in nested arguments. The user often cannot see the instruction source, the exact tool schema the model received, or the data the tool will return.

Research has shown structural failures:

• Tool poisoning places instructions in tool descriptions consumed by the model but not fully shown to the user.
• Line jumping can influence the agent during discovery, before invocation reaches the expected approval boundary.
• A rug pull can change a tool description after the user approved a tool with the same name.

An approval tied only to tool_name=send_message is weak. The model may have acted on a different definition than the human understood.

Broad standing consent fails in the other direction

If per-action prompts cause fatigue, teams ask once for broad scopes and suppress later prompts. That creates standing authority larger than any one task requires.

MCP supports incremental scope challenges, which improve on requesting every possible scope up front. The model still operates at scope granularity. It does not normally constrain tool arguments, use counts, delegation depth, or instruction source.

The missing object is a task grant. Task-scoped agent authority binds operations, arguments, limits, expiry, and approval rules to one purpose.

Safe authorization needs four outcomes

Binary allow/deny is too small for agent workflows. A deterministic policy engine needs four results:

allow
deny(reason)
require_step_up(requirement, expires_at)
require_approval(profile, expires_at)

require_step_up means the principal is known but the current authentication assurance is insufficient. require_approval means the action is valid enough to review but cannot execute yet.

These are intermediate authorization states, not errors.

Approval must bind to the exact action

A defensible approval record should include a digest over the security-relevant request:

digest = SHA-256(
  principal_id || agent_id || tool_definition_hash ||
  normalized_arguments || policy_version || expires_at
)

At execution time, re-evaluate everything that can change:

• principal and agent lifecycle;
• grant expiry, use count, and revocation;
• approver authority and step-up freshness;
• tool-definition hash and normalized arguments;
• current policy version; and
• whether the approval was already consumed.

If any answer fails, do not call the provider. An approval is not a transferable “yes.” It is a single-use authorization for one frozen action.

AuthZEN models “not yet” as a protocol state

In June 2026, the OpenID Foundation approved the Access Request and Approval Profile and COAZ MCP profile as AuthZEN Working Group Drafts.

AARP defines how an authorization system can say that a request is not authorized yet because a prerequisite remains. That prerequisite may be approval, consent, stronger authentication, delegated authority, attestation, risk assessment, or justification.

The requester receives a handle for the pending request. Once the prerequisite is satisfied, it resumes and asks for a fresh decision. An automated governance system may satisfy some prerequisites; a human is not required for every pause.

This is the right abstraction because an agent needs a proper way to handle “not yet.” Without one, clients treat policy friction as a generic failure and may retry or route around it.

Both documents are Working Group Drafts, not final specifications. Their state machine is still useful now.

Policy should handle the routine path

Approval by exception only works when policy safely allows ordinary actions. Useful inputs include:

• principal lifecycle and authentication assurance;
• agent owner, sponsor, purpose, and status;
• resource, tool, and immutable tool-definition version;
• arguments and data classification;
• task-grant expiry and remaining uses;
• recipient domain, amount, or record count; and
• whether untrusted input, sensitive data, and external action coexist.

The model may provide a justification. It must not decide whether its own justification is sufficient.

Policy should be versioned, deterministic, and evaluated outside the model. Record the version used without copying sensitive tool arguments into a general audit stream.

Consent still has a role

Use consent for durable relationships: connect this application, authorize this agent, permit this data category, or allow this class of task. Use policy for routine decisions inside those boundaries. Use approval when a particular action crosses a threshold.

Trying to make one dialog answer all three produces either fatigue or over-broad authority.

The future of agent authorization is not humans clicking “Allow” faster. It is systems that know which actions need no human, which must never happen, and which rare decisions deserve an informed, attributable pause.