Hi all, Support for advancing draft-ietf-oauth-transaction-tokens. Review comments from an implementer's perspective - we build agent-orchestration infrastructure where transaction context propagation across service hops is load-bearing for audit evidence, so this document matters to us downstream.
Three comments, none blocking: 1. Replacement semantics and audit trails (section on Txn-Token replacement): when a token is replaced mid-transaction, the draft is clear on how the replacement is minted but lighter on what an auditor reconstructing the transaction later can rely on. A short paragraph stating that the replacement chain SHOULD be reconstructible from retained tokens alone (each replacement bearing a verifiable reference to its predecessor) would strengthen the document for compliance-driven deployments - in our sector, the transaction record is frequently reviewed by a party who was not present at execution time and holds only the artifacts. 2. The requester_context claim and downstream trust: the draft appropriately leaves requester_context extensible. It may be worth an explicit security consideration noting that downstream workloads MUST NOT treat requester_context contents as verified claims about the original requester unless those contents are independently signed - we have observed implementers conflate "carried in a signed token" with "attested by the issuer," which are different assurances. 3. Interaction with human-origin transactions: for transactions that originate from a human action, the draft's model carries the subject through sub_id. For deployments where regulation requires demonstrating that a specific natural person stood at the origin of the chain (our case: legal and critical-infrastructure settings under EU AI Act-adjacent obligations), it would help to note that sub_id MAY reference an identity assurance mechanism defined outside this document. No normative change needed — a sentence acknowledging the composition point would prevent divergent profiles. We have documented one such root mechanism in draft-zagarella-verified-human-root-00 <https://datatracker.ietf.org/doc/draft-zagarella-verified-human-root/>, offered as a composition example rather than a dependency. Thanks to the authors - the transaction-boundary framing is the right one, and we intend to implement. Roberto Antonio Zagarella Violet Shores — VAC Protocol / Athena https://vacprotocol.org
_______________________________________________ OAuth mailing list -- [email protected] To unsubscribe send an email to [email protected]
