Agent authentication: design OAuth 2.1 onboarding for introduction tools

[sajeetharan]

Problem

To allow agents to request/perform state-changing introduction tools securely on behalf of users, we need a robust OAuth 2.1 protocol design instead of static pre-issued keys. Public searches must remain anonymous.

Acceptance Criteria

• Complete threat model and security design document.
• Detail protected resource metadata and authorization server decision.
• Define delegated scopes for introduction actions.
• Implement token rotation and revocation.
• Define transition/migration plan from pre-issued keys to OAuth.
• Maintain anonymous access for public agent search.
• Tests.

Dependencies

• Security design dependency. Public search must remain anonymous.