Hello OAuth WG, I would appreciate feedback on a narrow interoperability question connected to existing agent-authorization and revocation work.
RFC 7009 addresses token revocation, and draft-chen-oauth-agent-revocation-00 explores agent-level cascade operations. My individual Informational draft, draft-watts-oauth-agent-revocation-closure-01, separates three events: receipt of a revocation request, invalidation of authority artifacts, and an evidence-backed claim that consequential operations within a declared scope can no longer commit using the revoked authority epoch. Document: https://datatracker.ietf.org/doc/draft-watts-oauth-agent-revocation-closure/ Concrete scenario: A delegated agent is revoked after an asynchronous operation has been queued and after a derived token has been issued. An upstream endpoint reports completed revocation, while a downstream job can still commit. The draft models this using scoped closure, enforcement cut sets, unresolved-path statuses, and authority epochs. This is intended to complement existing OAuth work, not change RFC 7009 or introduce a new grant type. I would value WG guidance on: 1. Whether any existing draft already defines the interoperable conditions for asserting downstream effect closure, as distinct from invalidating tokens or returning cascade counts. 2. Whether an interoperable scoped closure indication is useful across administrative domains, or whether it should remain implementation-local. 3. If this merits WG attention, whether narrow requirements and negative test vectors would be more valuable than a new protocol object. I am particularly interested in contrary examples or prior art demonstrating that current semantics already cover this case. The current document is an individual I-D, not a WG-adopted document. Regards, Deonté O’dell Watts Independent Researcher | GoodShyt Group Inc. ORCID: 0009-0005-8586-3650 https://datatracker.ietf.org/doc/draft-watts-oauth-agent-revocation-closure/ _______________________________________________ OAuth mailing list -- [email protected] To unsubscribe send an email to [email protected]
