Dick Hardt

Dick Hardt is the founder and CEO of Hellō and the editor of OAuth 2.0, a framework that lets applications obtain limited access to a user’s resources without needing the user’s password. He is developing AAuth with others in the identity community, exploring how AI agents can identify themselves and obtain permission as they work across services.

From developer tools to digital identity

Hardt founded ActiveState, where he led the port of Perl to Windows and oversaw ports of Perl and Python to .NET. ActiveState also applied Perl’s text-processing capabilities to email filtering: PerlMx evolved into the enterprise spam-filtering product PureMessage. Hardt sold the company to Sophos in 2003.

He then founded Sxip Identity to work on user-controlled online identity. Its Simple Extensible Identity Protocol separated identity assertion from authentication, and Hardt and his colleagues brought the technology into OpenID 2.0, which he co-authored. In his Identity 2.0 writing, he described an identity agent that manages identity for a person, alongside services that issue claims and sites that consume them.

At Microsoft, Hardt edited OAuth 2.0, published in 2012. The framework gives an application an access token with a defined scope and lifetime, so a user can, for example, let a printing service access photos without giving it the photo account’s password. The specification was a collaborative product of the OAuth working group. Hardt has also worked at Amazon and founded Bubbler.

Making identity easier to use

At Hellō, Hardt has pursued user choice and simpler integration for developers. Hellō combines identity providers behind one OpenID Connect integration, offering social login and enterprise single sign-on. Its GitHub offboarding product links corporate and GitHub identities so access can be revoked when someone leaves; Hellō also lists a broader application-offboarding product as forthcoming.

Hardt’s work extends into the standards behind those products. In 2025, he and Karl McGuinness created the OpenID Provider Commands draft, which proposes standardized commands for identity providers to manage user accounts at applications. He also experimented with an MCP server for managing Hellō applications from a coding environment, motivated by the friction developers face when setting up authentication. Both projects appear in his Hellō writing.

Authorization for agents

Hardt began AAuth after implementing authorization for an MCP server and concluding that OAuth was a poor fit for that use. His concern is that agents can discover services and decide what access they need while a task is underway. An integration configured in advance, or a standing permission such as read access to mail, may say little about what an agent is trying to accomplish on a particular call.

His AAuth Internet-Draft is a work in progress built around several ideas:

• Agent identity: Each agent instance has an identifier bound to a signing key. A resource can verify a signed request and apply access controls without issuing the agent a shared API key.
• User delegation: A person server can represent the user, handle consent, and help obtain authorization as an agent encounters resources. The resource can retain its own policy decisions or use its existing authorization infrastructure.
• Missions and context: An optional mission describes an agent’s intended work. The person server can use it and the mission’s log to evaluate subsequent requests in context, while resources enforce their own access policies.

AAuth is designed to coexist with OAuth and OpenID Connect. Its missions also have limits: an approved list of local tools records what a person agreed to, but the protocol itself cannot enforce local tool use.