Computer-implemented systems for distributed authorization and federated privacy exchange

A computer-implemented system for providing an authorization service for allowing a service provider client device to access a protected resource stored at a resource server, the system comprising:

• an authorization hardware server configured to:
• register the protected resource against a generic resource definition that does not identify the resource owner and that can be mapped by the resource server to the protected resource when responding to the service provider client device upon successful authorization of access to the protected resource, wherein a capability of the service provider client device or a capability of the resource server is defined against a resource definition, the resource definition comprising an interface schema;
• provide a resource owner interface for an agent device to authenticate the resource owner;
• and
• delegate permission gathering and authentication to the agent device upon receiving a request from the service provider client device;
• and
• the agent device communicatively connected to the authorization hardware server, the agent device configured to:
• provide an agent interface for managing credentials and controlling permissions and policies at the authorization hardware server;
• and
• store protected data including any one or more of account identifier data, authenticator data, resource server relationship data, and permissions data.

A method of authorizing access by a service provider client to a protected resource stored at a resource server using a resource definition, the method comprising:

• defining a capability of the service provider client or a capability of the resource server against a resource definition, the resource definition comprising an interface schema;
• storing the resource definition at an authorization hardware server;
• providing a resource owner interface for an agent device to authenticate the resource owner;
• delegating permission gathering and authentication to the agent device upon receiving a request from the service provider client;
• and
• registering, at the authorization hardware server, the protected resource generically against a generic resource definition, wherein the generic resource definition does not identify the resource owner and can be mapped by the resource server to the protected resource when responding to the service provider client upon successful authorization of access to the protected resource.