Hi all, I support adoption, as a starting point.
Holder-signed delegation is useful for agents where no AS is in the loop (cross-domain, offline). Some things that the WG would need to address: 1. Attenuation: a Delegate Payload can add claims, and Section 6 gives no rule for combining payloads. Ideally, delegates should not be able to widen a predecessor's claims. 2. Lifetime: ideally, a delegation's exp should not exceed its predecessor's. 3. Limits: define claims for maximum depth and "no further delegation" (Section 8.2 names none). 4. Revocation: recommend Token Status List for the root (Section 8.3). 5. Applicability: say when holder-signed delegation fits versus AS-mediated delegation (RFC 8693, transaction tokens). Best, Sharath > On Sep 28, 2026, at 5:21 AM, Rifaat Shekh-Yusef <[email protected]> > wrote: > > All, > > This is an official call for adoption for the Delegated SD-JWT draft: > https://datatracker.ietf.org/doc/draft-gco-oauth-delegate-sd-jwt/ > > Please reply, on the mailing list, on whether you support or oppose the > adoption of this draft as a WG document by October 12. > > Regards, > Rifaat & Hannes > > _______________________________________________ > OAuth mailing list -- [email protected] > To unsubscribe send an email to [email protected]
_______________________________________________ OAuth mailing list -- [email protected] To unsubscribe send an email to [email protected]
