Hello, This note replies to the 15 June 2026 announcement of
draft-niyikiza-oauth-attenuating-agent-tokens (Message-ID
<calgh9z_qkdyoqechyozbq62r2wtmbz0-znna+kqmmgrugnh...@mail.gmail.com>). A\UTH.io
ships urn:auth.io:envelope:v1 as an RFC 9396 authorization_details type (URN and JSON
Schema). Please treat that type as an AAT-compatible profile of this draft. This is
not a second Internet-Draft. Deltas to consider for the draft: 1. Resource-boundary
object. An organization anchor, plus a kind: standalone, user-namespace, project, or
group-subtree. 2. envelope_digest. SHA-256 of the operational capability bytes, so
the RAR/AAT view and the enforced capability cannot diverge. 3. Intermediate
proof-of-possession on each hop, not only the leaf. 4. A revocation-epoch hook a
verifier can compare, so a chain can be cut without putting third-party secrets in
the token. 5. A vocabulary member that pins the permission-catalog revision used by
actions[]. Happy to align these members with the existing authorization_details
profile. Thanks
_______________________________________________
OAuth mailing list -- [email protected]
To unsubscribe send an email to [email protected]
