A computer-implemented system (100, 300, 2100) for distributed authorization, the system comprising: a resource server (22, 312, 2112) which stores a protected resource of a resource owner and respects authorization server-issued authorization grants; a service provider client device (18,314, 2114), the service provider client device configured to provide a service which uses the protected resource; a federated privacy exchange system configured to provide an authorization service for allowing the service provider client device to access the protected resource according to permissions data (332, 516), the federated privacy exchange system comprising: a privacy-respecting authorization server (12, 318, 2118) configured to register the protected resource against a generic resource definition (726, 2130) that does not identify the resource owner and that can be mapped by the resource server to the protected resource when responding to the service provider client device upon successful authorization of access to the protected resource; and an agent device (16, 320, 2120) configured to: provide an agent interface for managing credentials (1948, 2048) and controlling permissions and policies (332, 730) at the authorization server; and store protected data including any one or more of account identifier data, authenticator data, resource server relationship data, and permissions data. a resource server (22, 312, 2112) which stores a protected resource of a resource owner and respects authorization server-issued authorization grants; a service provider client device (18,314, 2114), the service provider client device configured to provide a service which uses the protected resource; a federated privacy exchange system configured to provide an authorization service for allowing the service provider client device to access the protected resource according to permissions data (332, 516), the federated privacy exchange system comprising: a privacy-respecting authorization server (12, 318, 2118) configured to register the protected resource against a generic resource definition (726, 2130) that does not identify the resource owner and that can be mapped by the resource server to the protected resource when responding to the service provider client device upon successful authorization of access to the protected resource; and an agent device (16, 320, 2120) configured to: provide an agent interface for managing credentials (1948, 2048) and controlling permissions and policies (332, 730) at the authorization server; and store protected data including any one or more of account identifier data, authenticator data, resource server relationship data, and permissions data. a privacy-respecting authorization server (12, 318, 2118) configured to register the protected resource against a generic resource definition (726, 2130) that does not identify the resource owner and that can be mapped by the resource server to the protected resource when responding to the service provider client device upon successful authorization of access to the protected resource; and an agent device (16, 320, 2120) configured to: provide an agent interface for managing credentials (1948, 2048) and controlling permissions and policies (332, 730) at the authorization server; and store protected data including any one or more of account identifier data, authenticator data, resource server relationship data, and permissions data. provide an agent interface for managing credentials (1948, 2048) and controlling permissions and policies (332, 730) at the authorization server; and store protected data including any one or more of account identifier data, authenticator data, resource server relationship data, and permissions data.