Hi Dapeng, I support continuing this work. One boundary I would like the design team to test: a goal-level authorization can help a client negotiate what an RS requires, but it is not approval of the eventual exact action. A changed payment destination after negotiation, or a lost response after provider entry, needs its own decision and recovery rule.
We have published AEB <https://datatracker.ietf.org/doc/draft-schrock-action-evidence-boundary/> and an open vector pack <https://github.com/emiliaprotocol/emilia-protocol/tree/main/conformance/aeb-1> for that boundary. I would be glad to bring a small cross-system case to the design team and see where it belongs alongside existing OAuth work. Best, Iman On Wed, 30 Sep 2026 00:19:52 +0800, "刘大鹏(鹏成)" <max.ldp= [email protected]> wrote: Hello all, During IETF 126 we had a discussion on how OAuth can support fine-grained authorization for AI agents [1]. The topic generated a lot of interest in the room, and the poll showed support for continuing the discussion [2]. A quick summary of the problem space as presented in the session [3]: 1. Enabling clients to construct fine-grained authorization requests using: a. Goal state management, b. Discoverable domain-specific schemas for task and authorization definition, c. Task-in-goal evaluation requests 2. Establishing a negotiation pattern that allows a resource server to guide clients towards the required authorization The session also proposed forming a design team to explore this space [3]. Before IETF 127, we would like to hear from the WG: - Is this a direction the community is interested in pursuing? Replies on the list will help shape the discussion at IETF 127. [1] https://datatracker.ietf.org/meeting/126/materials/minutes-126-oauth-202607240700-00 [2] https://datatracker.ietf.org/doc/polls-126-oauth-202607240900/ [3] https://datatracker.ietf.org/meeting/126/materials/slides-126-oauth-sessb-policy-language-binding-for-oauth-00 Best regards,Dapeng Liu
_______________________________________________ OAuth mailing list -- [email protected] To unsubscribe send an email to [email protected]
