Hello Thilina, Jeff, Caleb, and OAuth WG participants, Thank you for the concrete questions and prior-art pointers. I agree that propagation, downstream cancellation, and in-flight work are general distributed-authorization problems, not properties unique to AI agents. Agent workflows are a motivating example, not a claim of AI-specific semantics or novelty.
The question I am trying to isolate is narrower than revocation signaling or token-state inspection: when an upstream component reports revocation complete, what can another administrative domain safely infer about already-queued consequential operations and derived authority? A token may be invalidated or a state-change signal delivered while a downstream job retains a path to commit an effect. In my draft, a scoped closure claim would require declared effect scope, authority epoch, enforcement coverage, and explicit unresolved or unknown status where those facts cannot be established. I do not assume this needs a new OAuth protocol object. Jeff's pointers to introspection, logout, status-list mechanisms, and the OpenID Shared Signals Framework are useful. I will compare their specified guarantees to the stronger proposed claim about downstream commit prevention, rather than treating absence of a matching term as a gap. Caleb's authorization-time attribution and bounded settlement window also exposes a key test case: whether an explicit revocation event permits already-authorized operations to settle, and, if so, how that exception is represented instead of labeling the entire scope closed. If there is an existing normative specification that already defines an interoperable, evidence-backed assertion about such queued downstream effects, I would welcome the precise reference or counterexample. Otherwise, a few negative test examples may be a better next contribution than additional protocol machinery. This remains discussion of an individual Internet-Draft, not a claim of WG adoption or consensus. Regards, Deonté O’dell Watts Independent Researcher | GoodShyt Group Inc. ORCID: 0009-0005-8586-3650 _______________________________________________ OAuth mailing list -- [email protected] To unsubscribe send an email to [email protected]
