I had separately also emailed about Transaction token for agents draft too.
Sharing it here - I would like to request agenda time at the upcoming IETF 127 meeting (under the OAuth WG or relevant tracks like WIMSE) to present and discuss two related drafts: 1. draft-araut-oauth-transaction-tokens-for-agents-02 https://www.ietf.org/archive/id/draft-araut-oauth-transaction-tokens-for-agents-02.html 2. draft-oauth-transactiontokens-bcp-01 https://www.ietf.org/archive/id/draft-oauth-transactiontokens-bcp-01.html ### Core Problem & Proposal Modern service-oriented architectures and multi-agent AI ecosystems struggle with context-aware authorization, dynamic delegation, and maintaining end-to-end auditability across deep call chains. These drafts address these gaps by defining how to pass agentic context as a first-class claim inside transaction tokens. This mechanism directly enables zero trust, fine-grained observability, and clear accountability across heterogeneous microservices and AI agent boundaries. ### Industry Adoption & Real-World Validation * Production Scale at Amazon: Amazon currently issues 500 billion transaction tokens equivalent per day utilizing these underlying architectural concepts. As the one of the top active draft originating from Amazon in this area, sharing this operational experience with the broader community aims to help establish a unified open standard. * Broader Ecosystem Traction: - Revi AI has implemented this model. - Industry leaders are actively building around it (e.g., Sean O'Dell at CVS published their end-to-end agentic security strategy explicitly citing this draft). Regards, Ashay Raut On Thu, Oct 15, 2026 at 2:18 AM Atul Tulshibagwale <atul.tulshibagwale= [email protected]> wrote: > Hi Rifaat, > On a related note, I'd like to discuss the Transactional Access Tokens > <https://www.ietf.org/archive/id/draft-tulshi-oauth-transactional-access-tokens-00.html> > proposal too. It relates to the work George, Pieter, and Sean are doing. > > Thanks, > Atul > > On Wed, Oct 7, 2026 at 7:32 AM <[email protected]> wrote: > >> I would like to talk about using transaction tokens to cross trust domain >> boundaries in the WIMSE/OAuth joint session. This is a key capability for >> organizations deploying transaction tokens and a resource server downstream >> in the chain needing to invoke a service in a different trust domain. The >> current version of the individual draft can be found here: >> >> [datatracker.ietf.org]Transaction Token Authorization Grant Profile for >> OAuth Identity and Authorization Chaining [datatracker.ietf.org] >> <https://urldefense.com/v3/__https://datatracker.ietf.org/doc/draft-fletcher-transaction-token-chaining-profile/__;!!BmdzS3_lV9HdKG8!z_CRAwMnx8qIzsNsxnn1Qmkfjn40wrqfkcf0EZxgqeQswXF4zXvWkodF0gjH2hgPV-pVsBNlvnGUD_p_Zpc$> >> datatracker.ietf.org [datatracker.ietf.org] >> <https://urldefense.com/v3/__https://datatracker.ietf.org/doc/draft-fletcher-transaction-token-chaining-profile/__;!!BmdzS3_lV9HdKG8!z_CRAwMnx8qIzsNsxnn1Qmkfjn40wrqfkcf0EZxgqeQswXF4zXvWkodF0gjH2hgPV-pVsBNlvnGUD_p_Zpc$> >> [image: ietf-logo-nor-180.png] [datatracker.ietf.org] >> <https://urldefense.com/v3/__https://datatracker.ietf.org/doc/draft-fletcher-transaction-token-chaining-profile/__;!!BmdzS3_lV9HdKG8!z_CRAwMnx8qIzsNsxnn1Qmkfjn40wrqfkcf0EZxgqeQswXF4zXvWkodF0gjH2hgPV-pVsBNlvnGUD_p_Zpc$> >> <https://urldefense.com/v3/__https://datatracker.ietf.org/doc/draft-fletcher-transaction-token-chaining-profile/__;!!BmdzS3_lV9HdKG8!z_CRAwMnx8qIzsNsxnn1Qmkfjn40wrqfkcf0EZxgqeQswXF4zXvWkodF0gjH2hgPV-pVsBNlvnGUD_p_Zpc$> >> >> The authors will be publishing an update before IETF 127. >> >> Thanks, >> George >> >> -- >> George Fletcher >> Practical Identity LLC >> >> On Oct 6, 2026, at 1:54 PM, Rifaat Shekh-Yusef <[email protected]> >> wrote: >> >> >> All, >> >> The OAuth working group chairs have requested *2 two-hour* meeting slots >> on the agenda for *IETF 127 *in San Francisco. >> >> In addition, as the intersection between the work of the WIMSE and OAuth >> working groups becomes increasingly important, >> the chairs of both groups have requested an *additional two-hour joint >> session* dedicated to topics that touch both groups. >> For example, transaction tokens are defined as OAuth artifacts but relate >> directly to workload security. >> >> At this time the OAuth chairs are soliciting proposals for both the >> dedicated OAuth sessions and the joint WIMSE/OAuth session. >> Please send your requests to the mailing list or directly to the chairs, >> indicating whether your request is for the OAuth session, >> the joint session, or could fit in either session. >> >> *Current working group items and proposals with demonstrated interest >> from multiple different parties will get priority.* >> >> Please note that the Internet-Draft submission cut-off is Monday, 2 >> November 2026 at 23:59 UTC [1]. >> Please ensure that new drafts and updates to existing drafts are >> published in Datatracker before the deadline. >> >> Regards, >> Rifaat and Hannes >> >> [1] https://datatracker.ietf.org/meeting/important-dates/ >> [datatracker.ietf.org] >> <https://urldefense.com/v3/__https://datatracker.ietf.org/meeting/important-dates/__;!!BmdzS3_lV9HdKG8!z_CRAwMnx8qIzsNsxnn1Qmkfjn40wrqfkcf0EZxgqeQswXF4zXvWkodF0gjH2hgPV-pVsBNlvnGUCXWrCi0$> >> >> _______________________________________________ >> OAuth mailing list -- [email protected] >> To unsubscribe send an email to [email protected] >> >> _______________________________________________ >> WIMSE mailing list -- [email protected] >> To unsubscribe send an email to [email protected] >> > _______________________________________________ > WIMSE mailing list -- [email protected] > To unsubscribe send an email to [email protected] >
_______________________________________________ OAuth mailing list -- [email protected] To unsubscribe send an email to [email protected]
