Hi all,
I've published draft-martinez-itp-agent-mandates, part of the Invoice Trust
Protocol (ITP) drafts posted to DISPATCH this week:
https://datatracker.ietf.org/doc/draft-martinez-itp-agent-mandates/
It lets a business authorize a software agent to issue, accept, reject or
dispute invoices within limits it sets. The authorization is a
mandate: an SD-JWT VC issued by the business to a key held by the agent,
revocable through a status list, and enforced by a single named node that
records every use, so the limits hold even if the agent misbehaves.
I'm not asking the WG to take this on. I'd just like feedback from people who
know these specs well, mainly on three points:
1. Using "aud" to name the enforcing node while other relying parties still
process the mandate (Section 3).
2. Attenuated delegation from one agent to another (Section 6).
3. Whether this overlaps with work already going on here, such as Rich
Authorization Requests or Token Exchange, in a way I've missed.
Thanks,
Carlos Martínez García-Villarrubia
BeeL.
_______________________________________________
OAuth mailing list -- [email protected]
To unsubscribe send an email to [email protected]
