Agent Wranglers

AGT-8Recommended

Name the agent on the consent screen

The consent screen names the agent as well as the app, lists each permission in plain words, and states when the grant ends.

By Agent Wranglers. Updated .

How to do it

People approve what they can read. "Example Assistant wants access to your account" hides that a trip-planning agent inside it will book and pay. Show the client name from its registration or metadata document and the agent's name. Show the host that published the client metadata, so a look-alike name stands out. Write each scope as an action, such as "Create bookings in your name". Show the end date, and link to the page where the person can revoke it. Revocation itself follows Let users revoke one agent without the others.

Examples

JavaScript example

const SCOPE_WORDS = { 'bookings:read': 'See your bookings', 'bookings:create': 'Create bookings in your name' };
export const consentLines = scopes => scopes.map(scope => SCOPE_WORDS[scope] ?? (() => { throw new Error(`no wording for ${scope}`); })());

Python example

SCOPE_WORDS = {"bookings:read": "See your bookings", "bookings:create": "Create bookings in your name"}

def consent_lines(scopes: list[str]) -> list[str]:
    missing = [scope for scope in scopes if scope not in SCOPE_WORDS]
    if missing:
        raise KeyError(f"no wording for {missing}")
    return [SCOPE_WORDS[scope] for scope in scopes]

How to check

A browser test starts an authorization for a test agent with two scopes. The consent page shows the agent's name, the client host, one plain sentence per scope and an end date. No scope is shown by its raw name only.

Sources

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/agents-as-users/delegated-access-and-consent/agent-on-consent-screen">Agent Wranglers agents as users playbook</a>. In code you write, add a comment next to it with the same link.