Hi Srini,
Thanks for this PR that significantly improves the text about bot managers. I
have approved it with one change suggestion.
Other WG members, feel free to review and comment or approve.
Thanks,
-- Mike
Subject: [OAUTH-WG] draft-skyfire-oauth-using-kyapay-tokens: PR correcting bot
manager layer characterization (§2.1, §3.4, §6.3)
From: "Thumma, Srini" [email protected]<mailto:[email protected]>
Tue, 15 September 2026 02:58 UTC
Hi all,
I've opened a PR against draft-skyfire-oauth-using-kyapay-tokens:
https://github.com/skyfire-xyz/draft-skyfire-oauth-using-kyapay-tokens/pull/3
Two changes:
1. Layer characterization (§2.1, §3.4, §6.3). The draft describes bot
managers as operating at the network/transport layer (L3/L4). In practice, they
operate inline at the application layer (L7): they terminate and inspect HTTP,
inject client-side instrumentation, and score behavioral and fingerprint
signals - none of which is available at L3/L4. The PR corrects the definition
accordingly.
2. Reframing §6.3 around self-identification and policy. The section is
rewritten so a KYA token turns the detection model into a self-identification
model: by presenting a valid token, an agent identifies itself as automated up
front, the bot manager verifies it (signature against the issuer's keys, issuer
trust, validity, audience) and classifies the request as a verified agent - so
it need not run its behavioral/fingerprinting heuristics to prove the traffic
is automated. Untokened traffic falls back to the standard pipeline. Crucially,
identification is decoupled from admission: token verification provides
authenticated context (hid, apd, aid), but admission remains a site-configured
policy decision (admit, rate-limit, step-up, deny), not a bypass.
Feedback welcome, on the PR.
Thanks,
Srini
_______________________________________________
OAuth mailing list -- [email protected]
To unsubscribe send an email to [email protected]
