CIBA (human approval)
In short:CIBA, Client-Initiated Backchannel Authentication, lets an app ask a person to approve something on another device. The person gets a prompt on their phone and approves or declines. For agents, it is a standard way to put a human in the loop for a risky action.
What is it?
The client sends a backchannel request naming the user. The authorization server notifies the user out of band.
The client polls or receives a callback once the user decides.
Why do agents need it?
Agents act while their person is elsewhere. CIBA gives a standard shape to asking that person for consent before a sensitive step.
Auth0 for AI Agents offers asynchronous authorization through CIBA.
Which scored platforms name it?
Not found in public material for any of the ten scored platforms.
Other scored platforms: not found in public material read on 3 November 2026.
Other standards
- OAuth 2.1
- MCP authorization
- Enterprise-Managed Authorization (Cross App Access, ID-JAG)
- Client ID Metadata Documents (CIMD)
- SPIFFE
- DPoP and mTLS
- OAuth token exchange (RFC 8693)
Sources
- [a0-ga] Auth0 for AI Agents generally available. https://auth0.com/blog/auth0-for-ai-agents-generally-available/. Read .