Hi Yaron, By coincidence I've been writing a draft on the schema side of this direction, and it's now up on datatracker [1]. (It grew out of IETF 126 and offline discussions, slides [2]; authors to be added as it settles.)
It defines a framework for domain-specific authorization schemas: a schema instance travels in the authorization request via authorization_details, and once approved, it governs the authorization, with a defined lifecycle and deterministic verification at the resource server. Comments welcome on the list. I hope it can serve as useful input for the discussion at IETF 127. [1] https://datatracker.ietf.org/doc/draft-liu-oauth-authorization-schemas/ [2] https://datatracker.ietf.org/doc/slides-126-oauth-sessb-policy-language-binding-for-oauth/ Dapeng Liu ------------------原始邮件 ------------------ 发件人:Yaron ZEHAVI <[email protected]> 发送时间:Sun Oct 11 18:37:38 2026 收件人:Blake Morrison <[email protected]>, [email protected] <[email protected]> 抄送:Omri Gazitt <[email protected]> 主题:[OAUTH-WG] Re: 回复：Re: Call for interest: fine-grained authorization in OAuth (IETF 126 follow-up) Dear Blake, Dapeng, Karl, Ron, Kieran & Omri, I've drafted up the authority metadata proposal: https://datatracker.ietf.org/doc/draft-zehavi-oauth-authority-metadata/ I'm aiming authority metadata to support at any token issuance and exchange decision, also without a mission context. In proposed model an AS has its local policy on authority, which can be tightened (but not relaxed) by protected resource metadata describing the authority (actions, effects, risks) a protected resource assigns scopes and RAR types. I hope this is a helpful shape. Feedback welcome. Yaron Classification: GENERAL -----Original Message----- From: Blake Morrison <[email protected]> Sent: Thursday, October 8, 2026 5:13 AM To: [email protected] Subject: [OAUTH-WG] Re: 回复：Re: Call for interest: fine-grained authorization in OAuth (IETF 126 follow-up) This message is from an external sender - be cautious, particularly with links and attachments. Hi Dapeng, Karl, Yaron, Ron, Kieran, Interested. I'd like to add one piece to the problem statement. Both layers in the thread check against the approved Mission. That's Yaron's authority metadata before issuance and Ron's record comparison after it. But the Mission starts as the agent's Intent. The user said "buy product A" before any Intent existed and what they approve is the agent's reading of it. Karl's Mandate commits to that approved intent so it carries the reading rather than the instruction. That piece is evidence of the instruction that started the Mission. 4.3 of Karl's submission evidence draft has the exchange establish the presenter which is the client. The person who gave the instruction isn't a party to it. The evidence also has to survive shaping and 4.2 only lets it name the shaped intent_hash if the type defines a lineage from input_digest. I'm happy to write the requirement up for whichever draft takes it. Blake _______________________________________________ OAuth mailing list -- [email protected] To unsubscribe send an email to [email protected] This message and any attachment ("the Message") are confidential. If you have received the Message in error, please notify the sender immediately and delete the Message from your system, any use of the Message is forbidden. Correspondence via e-mail is primarily for information purposes. RBI neither makes nor accepts legally binding statements via e-mail unless explicitly agreed otherwise. Information pursuant to § 14 Austrian Companies Code: Raiffeisen Bank International AG; Registered Office: Am Stadtpark 9, 1030 Vienna, Austria; Company Register Number: FN 122119m at the Commercial Court of Vienna (Handelsgericht Wien). _______________________________________________ OAuth mailing list -- [email protected] To unsubscribe send an email to [email protected]
_______________________________________________ OAuth mailing list -- [email protected] To unsubscribe send an email to [email protected]
