Hello all, A short note in case it is useful to anyone on the list. I've written a technical monograph, Delegated Authority in Financial Systems: From OAuth to Autonomous Agents, and a review draft is open for comments until 30 November 2026 before it goes to publication.
I'm a staff software engineer at PayPal and built its open banking platform; I'm writing in a personal capacity; my background is at https://www.linkedin.com/in/ratnadeepsimhadri/ . The book's argument is that OAuth binds authority to a client's identity, which works while clients run fixed programs, and that autonomous agents break that assumption. The chapters most relevant to this group are Chapter 2 (grants, codes and tokens), Chapter 3 (scope and its limits), Chapter 4 (FAPI), Chapter 11 (chained delegation: Token Exchange, identity chaining, transaction tokens, and the recent proposals extending the act claim), Chapter 12 (MCP, A2A and AP2 authorization), and Chapter 14 (revocation: RFC 7009, global token revocation, Shared Signals and CAEP). Every draft is cited by revision and date, with its status as of 6 October 2026, and I'd welcome corrections where that status has moved. The review folder, with a one-page brief that says which chapters suit which reader, is here: https://drive.google.com/drive/folders/16Th8gy1lkkf6YU9mFDGkF_wZF6MLNBRc Comments go in the Google Docs; if the link asks for access, request it and I'll approve. Reviewers who wish it are acknowledged in the published edition. Thank you, and apologies to anyone for whom this is noise. Ratnadeep Simhadri [email protected] https://www.linkedin.com/in/ratnadeepsimhadri/
_______________________________________________ OAuth mailing list -- [email protected] To unsubscribe send an email to [email protected]
