Hello OAuth WG, I have prepared revision -02 of "Revocation Closure and Authority Epochs for Agent Delegation" for feedback. The revision is currently being processed in the Datatracker.
The draft addresses a narrow gap in complex delegation: an RFC 7009-style token or grant invalidation does not by itself establish that all authority derived from that authorization can no longer cause a new consequential effect. In agent and multi-workload systems, exchanged tokens, delegated children, cached decisions, and queued or delayed work can survive the invalidation event. The draft therefore separates: revocation request != token/grant invalidation != delegated-authority closure and defines scoped authority epochs, delegation lineage, admission/queue fencing, and CLOSED/PARTIAL/FAILED/UNKNOWN semantics. UNKNOWN is never promoted to CLOSED. The profile composes with RFC 7009, RFC 8693, RFC 7662, DPoP, Transaction Tokens, and WIMSE/AIMS; it defines no new grant type, token format, endpoint, or IANA registry. The document page is: https://datatracker.ietf.org/doc/draft-watts-oauth-agent-revocation-closure/ I would appreciate feedback on whether this closure semantic belongs as OAuth WG work, should be folded into adjacent agent-revocation/delegation work, or needs further narrowing before adoption discussion. Best, Deonte O'dell Watts ORCID: https://orcid.org/0009-0005-8586-3650 _______________________________________________ OAuth mailing list -- [email protected] To unsubscribe send an email to [email protected]
