Authorization consents

An authorization consent records a customer's approval for an OAuth2/OIDC client to access a protected resource on their behalf. During authorization, customers can see which application or agent is requesting access, which resource it wants to access, and the permissions being requested.

Authorization consents apply to AI agents and other OAuth2/OIDC clients that use delegated access.

When customer authorization is required

Protected resources define the scopes available for a resource. When you assign a protected resource to an OAuth2/OIDC client, you determine which scopes that client can request and which access requires customer authorization.

When a client requests access that requires authorization:

1. Strivacity authenticates the customer.
2. Strivacity presents the client, protected resource, and requested access to the customer.
3. The customer reviews the request and decides whether to continue.
4. Strivacity records the authorization and can issue access based on the approved permissions.

A previous authorization can be reused when the same client requests access the customer has already approved. If the client later requests additional access that requires authorization, the customer can be asked to approve the additional permissions.

Authorization consent experience

The authorization consent screen provides the information customers need to understand the access being requested.

Depending on the authorization request, it can identify:

• The AI agent or other application requesting access.
• The protected resource the client wants to access.
• The permissions requested for the protected resource.
• Access to the customer's account through OAuth2/OIDC.

Customer-facing names, logos, and scope descriptions help customers recognize the requesting client and understand the permissions they are granting.

For dynamically configured clients, additional information about the client can be provided through Client ID Metadata Documents (CIMD).

Review and revoke access

Customers can review the agents and applications they have authorized from My Account.

Their authorization information shows which agent or application has access and the permissions that have been granted. Customers can remove authorization when they no longer want the client to access their account.

If an associated client or protected resource is disabled, its authorization consent remains visible as disabled and can still be removed. If the associated configuration is deleted, the remaining authorization record indicates that access has been removed and can also be deleted by the customer.

Administrative access

Brand administrators can review a customer's authorization consents from the customer's account in the Admin Console and remove access on the customer's behalf.

Authorization consents are managed separately from the customer's privacy and data-processing consents.

Account events

Authorization consent activity is reflected in account events, including authorization performed during login and changes to access granted to agents and applications.

Use Account events when you need to investigate the customer authorization journey or review changes to delegated access.

Where to go next

• Protected resources: where scope descriptions are defined.
• AI agents: the client-side consent settings.
• Account events: the full account events reference.