If you've implemented OAuth scopes, you've already touched the edge of a 600-year-old governance system.

In January 2025, South, Marro, Hardjono, Mahari, and Pentland published arXiv:2501.09674 — a three-token architecture for AI agent authorization extending OAuth 2.0 and OpenID Connect:

User ID-token — standard OIDC identity. Who owns the agent.

Agent-ID token — the agent's capabilities, limitations, and unique identifier.

Delegation token — cryptographically signed, scoped, revocable. The authorization itself.

They didn't reference privateering. But the architecture they built is the same one Western maritime law spent 300 years refining.

The Original OAuth: Letters of Marque

Before a Baltimore privateer could leave harbor in 1812, the owner had to:

Declare the vessel's name, tonnage, and armament (identity)

Receive a commission specifying exactly which ships they could attack (scope)

Post a $5,000–$10,000 bond (accountability)

Submit every capture to a vice-admiralty prize court…