# Agent Authentication Policy (auth.md)

> Formal authentication and identity discovery metadata for autonomous AI agents, web reasoning models, and automated crawlers querying Gymnázium Vavrinca Benedikta Nedožerského (`https://www.gympd.sk`).
> Specification: [WorkOS auth.md](https://github.com/workos/auth.md), RFC 8414 (OAuth 2.0 Authorization Server Metadata), and RFC 9728 (OAuth 2.0 Protected Resource Metadata).

---

## 1. Overview & Access Model

The GVBN website (`gympd.sk`) is an official Slovak public educational institution portal. The vast majority of resources (curricula, admissions criteria, search indices, news feeds, teacher directories, documents, brand assets) are public educational records.

- **Default Mode:** `anonymous` (Open public read-only access).
- **Authentication Requirement:** None for public data retrieval, search queries, and content parsing.
- **Agent Protocols Supported:** WebMCP (in-page tool registration), Schema.org JSON-LD, OpenAPI/LLMs.txt, RSS/JSON Feeds, RFC 8414, and RFC 9728.

---

## 2. Discovery Endpoints

Autonomous agents can discover resource and authentication capabilities via standard `.well-known` endpoints:

- **RFC 9728 Protected Resource Metadata (PRM):**
  `https://www.gympd.sk/.well-known/oauth-protected-resource`
- **RFC 8414 Authorization Server Metadata (AS):**
  `https://www.gympd.sk/.well-known/oauth-authorization-server`
- **Agent Manifest:**
  `https://www.gympd.sk/.well-known/agent.json`
- **AI Plugin Specification:**
  `https://www.gympd.sk/.well-known/ai-plugin.json`
- **Agent Instructions & When-To-Use:**
  `https://www.gympd.sk/agent-instructions.md`

---

## 3. Supported Identity Types & Assertion Formats

In accordance with the WorkOS `agent_auth` specification:

```json
{
  "agent_auth": {
    "identity_endpoint": "https://www.gympd.sk/auth/identity",
    "identity_types_supported": [
      "anonymous",
      "identity_assertion",
      "service_auth"
    ],
    "identity_assertion": {
      "assertion_types_supported": [
        "urn:ietf:params:oauth:token-type:id-jag"
      ]
    },
    "skill": "https://www.gympd.sk/auth.md"
  }
}
```

### Identity Modes:
1. **`anonymous` (Recommended):**
   - No token, API key, or exchange required.
   - Simply issue standard HTTP `GET` requests to `https://www.gympd.sk/*` or use browser-native WebMCP tools.
2. **`identity_assertion`:**
   - Supported token type: `urn:ietf:params:oauth:token-type:id-jag` (Identity Assertion JWT via RFC 8693 token exchange).
   - Agents representing verified enterprise entities or academic partners may present signed assertions to identify their caller agent.
3. **`service_auth`:**
   - Standard client credentials flow (`client_credentials`) for partner integration.

---

## 4. Scopes Supported

- `read:public` – Read publicly available educational, curriculum, news, and organizational records.
- `search` – Access to site-wide search indexing (`/data/search-index.json` and WebMCP search tools).
- `documents` – Access to public school documentation, annual reports, contracts, and educational plans.

---

## 5. Politeness & Rate Limits

- Standard rate allowance: Up to 5 requests per second per IP for automated crawlers.
- Identification: Automated agents are encouraged to set a descriptive `User-Agent` header (e.g., `MyAgent/1.0 (+https://example.com/agent-info)`).
- Questions or security inquiries: Contact `skola@gympd.sk`.