Hi Laxmikant, Just a quick follow-up to let you know that we have seen the proposed text you submitted on GitHub (Issue #30). Thank you for putting this together and opening the issue so quickly! We will review the text and incorporate it into the draft as soon as possible. We will keep you and the working group updated once the new version is ready. Best regards, Meiling
[email protected] From: Laxmikant Sharma Date: 2026-09-25 12:58 To: oauth CC: draft-chen-oauth-agent-authz-use-cases Subject: draft-chen-oauth-agent-authz-use-cases: data on responding to resource server challenges Hi all, Ahead of the 19 October interim on agent authorization use cases and gaps, here is some data on one of the gaps in draft-chen-oauth-agent-authz-use-cases. Section 6 (item 2) notes that the framework has no built-in mechanism for an agent "to respond to a real-time authorization challenge from a resource server". In September I ran eight shipped AI agents that act as MCP clients, in their mid-September releases, against a resource server that answered the first request with 401 and a WWW-Authenticate header carrying resource_metadata. The authorization server offered the authorization code grant with PKCE and accepted both client ID metadata documents and dynamic registration. Each client ran in a terminal on a machine with a browser, and a scripted test user completed any sign-in page a client opened or printed. In one-shot mode, one client completed the grant on its own, and a second did so only after the user set a per-server flag in its configuration. Two fetched the protected resource metadata, one of them also registered a client, and both stopped there. The other four made no authorization attempt, although one of them opened the browser within seconds and completed the grant when run as an interactive session instead. In a separate run the day before, all eight completed the same grant through their own sign-in steps. So every client can run the grant, and whether it runs it on a challenge is left to the client. A client that won't act on the challenge also has no standard way to say so, which leaves the resource server nothing to fall back on. Use Case 5 (Section 4.1.6) covers first connection when there is no front channel. This is the complementary case, where the front channel exists and the client doesn't use it. If the authors think it belongs in the document, I'm glad to open an issue on their tracker with proposed text. I also plan to publish the harness and the records once each client's maintainers have seen their results. Thanks, Laxmikant Sharma
_______________________________________________ OAuth mailing list -- [email protected] To unsubscribe send an email to [email protected]
