AARS — Agent Action Rights Spectrum

Agent Action Rights Spectrum

What can this Agent do, to what effect, and how reversibly? Content permission does not imply action permission.

01 · Definitie

AARS is a machine-readable rights-semantics layer for what an Agent may do once it holds tool or API capability — as distinct from what it may read or learn. It describes an action taxonomy, a multi-dimensional effect vector (read / write / execute / external communication / transaction / delegation / persistence), reversibility, blast radius, and multi-action composition risk, so a single allow/deny bit is replaced by an evaluable action-rights space. AARS does not replace OAuth, MCP, or existing authorization systems — it gives them a shared vocabulary for what an action is, before a policy decides whether to allow it.

02 · Doel

Separate content permission from operational (tool/API) permission: RAG access does not grant database writes.
Give every Agent action a machine-readable effect vector — read, write, execute, external communication, transaction, delegation, persistence — instead of a single risk score.
Distinguish static tool metadata (a self-declared hint) from runtime effect (what a specific invocation, with specific arguments, actually does).
Flag multi-action composition risk, where individually-safe actions combine into an unsafe capability (e.g. read-secret + external-publish).

03 · Reikwijdte

A0–A7 human-readable action spectrum — from no access through discover, read, query, reversible mutation, external action, privileged/transactional action, to persistent delegated autonomy

A machine-readable action vector (R/W/X/E/T/G/P) plus effect modifiers — reversibility, idempotency, open-world reach, blast radius, sensitivity, privilege impact, duration, confidence

Decision states beyond allow/deny — conditional, approval_required, step_up_required, unavailable, unknown (unknown never defaults to allow for a mutating action)

Static tool profile vs. runtime action profile — the same tool can carry very different effects depending on invocation arguments

Multi-action composition rules and capability amplification (e.g. read-secret + write-script + execute + external-upload = exfiltration capability)

Mapping to MCP tool annotations (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) and to OAuth 2.0 Rich Authorization Requests (RFC 9396)

04 · Machineleesbaar voorbeeld

A minimal AARS action policy

/ai/agent-actions.json

{
  "aars_version": "0.1",
  "resource": "mcp://mail.example",
  "default_decision": "deny",
  "actions": {
    "discover": { "decision": "allow" },
    "read": { "decision": "conditional", "sensitivity_max": "confidential" },
    "communicate": {
      "decision": "approval_required",
      "constraints": { "audience_scope_max": "named_external", "max_recipients": 1 }
    },
    "delete": { "decision": "deny" },
    "delegate": { "decision": "deny" }
  }
}

05 · Beperkingen

AARS is a rights-semantics vocabulary, not an enforcement engine — implementations must actually wire runtime evaluation to it.
It does not define who has authority to grant an action — that is AADP's scope.
It is an open research draft; this site does not claim AARS has been adopted by MCP, IETF, or any standards body.
The action taxonomy and vector dimensions are v0.1 and may change before a stable release.