Hi Blake,
Thanks for raising this. A problem and requirements write-up would help the WG
understand the gap.
We have a related draft, "Authorization Evidence and Audit Trail for OAuth 2.0
Access Tokens" [1]. It records what the user was shown and confirmed at consent
time, so a verifier can check what was actually approved.
We are working on a revision; the current version is here [2]. Comments welcome.
[1]
https://datatracker.ietf.org/doc/html/draft-liu-oauth-authorization-evidence-01
[2]
https://maxpassion.github.io/IETF-Agent-Operation-Authorization-draft/draft-liu-oauth-authorization-evidence-01.html
Regards,
Dapeng
------------------原始邮件 ------------------
发件人:Blake Morrison <[email protected]>
发送时间:Thu Oct 8 11:14:12 2026
收件人:'oauth' <[email protected]>
主题:[OAUTH-WG] Re: 回复：Re: Call for interest: fine-grained authorization in OAuth
(IETF 126 follow-up)
Hi Dapeng, Karl, Yaron, Ron, Kieran,
Interested. I'd like to add one piece to the problem statement.
Both layers in the thread check against the approved Mission. That's
Yaron's authority metadata before issuance and Ron's record comparison
after it. But the Mission starts as the agent's Intent. The user said
"buy product A" before any Intent existed and what they approve is the
agent's reading of it. Karl's Mandate commits to that approved intent
so it carries the reading rather than the instruction.
That piece is evidence of the instruction that started the Mission.
4.3 of Karl's submission evidence draft has the exchange establish the
presenter which is the client. The person who gave the instruction
isn't a party to it. The evidence also has to survive shaping and 4.2
only lets it name the shaped intent_hash if the type defines a lineage
from input_digest.
I'm happy to write the requirement up for whichever draft takes it.
Blake
_______________________________________________
OAuth mailing list -- [email protected]
To unsubscribe send an email to [email protected]
_______________________________________________
OAuth mailing list -- [email protected]
To unsubscribe send an email to [email protected]
