Rich Authorization Requests (RAR)

Rich Authorization Requests (RAR) provide fine-grained authorization constraints for OAuth 2.0 tokens used for AI agent with Vault. RAR embeds detailed access control rules directly in JWT tokens, enabling path-level and parameter-level restrictions beyond what standard ACL policies provide.

RFC 9396 defines RAR and extends OAuth 2.0 to support complex authorization scenarios. In Vault, RAR constraints work alongside ACL policies to narrow permissions without ever expanding them.

How RAR works with Vault

When a client presents an OAuth JWT containing RAR constraints in the authorization_details claim, Vault evaluates both ACL policies associated with the entity and any applicable RAR constraints. For a request to succeed:

1. The ACL policies must permit the operation.
2. The request path and operation must match at least one RAR constraint.
3. Any parameter-level constraints in the RAR must be satisfied.

RAR constraints can only restrict access, never granting permissions beyond what ACL policies allow.

OAuth credential requirement

Vault requires an agent registry record for clients that authenticate using OAuth resource server credentials, also called OAuth JWTs. An entity that has no agent registry record cannot use OAuth credentials to make requests. If you present an OAuth credential for an unregistered entity, Vault rejects the request.

In a delegation flow, where an agent acts on behalf of a subject, the actor entity must have a registration. In a direct, non-delegation flow, the subject entity must have a registration.

OAuth resource server configuration

The OAuth resource server configuration is a Vault Enterprise feature that defines how Vault validates JWTs issued by OAuth 2.0 authorization servers. By configuring one or more validation profiles, you establish trust relationships between Vault and external identity providers, enabling Vault to accept their JWTs as authentication credentials on every request without a separate login step.

Token header size

RAR-enriched JWTs can carry large authorization_details payloads. Vault rejects request with token header size exceeding default 8 KB limit. Raise max_token_header_size on the TCP listener to accommodate larger tokens. Refer to Token header size in the TCP listener configuration for details.