Yes! It's exactly about creating a standardized way for a website to expose its tools to the agentic web.
Auth is level 2 of this design. It is huge piece of the puzzle. My vision for this is that the kodec.txt protocol would evolve to include an optional authentication block, likely declaring a standard like OAuth 2.0.
Doing so, a trusted agent (that the user has already connected to their account, similar to a "Login with Google" flow) would see that the action requires authorization. The agent would then be responsible for managing the OAuth token on behalf of the user to securely make the authenticated API call.
For this POC, all the actions are public and unauthenticated to keep it simple, but your question is exactly where the protocol needs to go next to handle private, user-specific actions. It's a massive and exciting challenge. Thanks for bringing it up!
Auth is level 2 of this design. It is huge piece of the puzzle. My vision for this is that the kodec.txt protocol would evolve to include an optional authentication block, likely declaring a standard like OAuth 2.0.
Doing so, a trusted agent (that the user has already connected to their account, similar to a "Login with Google" flow) would see that the action requires authorization. The agent would then be responsible for managing the OAuth token on behalf of the user to securely make the authenticated API call.
For this POC, all the actions are public and unauthenticated to keep it simple, but your question is exactly where the protocol needs to go next to handle private, user-specific actions. It's a massive and exciting challenge. Thanks for bringing it up!