Hi all, I posted *draft-le-agent-passport-00* last week and have been discussing it on the WIMSE list. Several of its pieces are OAuth territory, so I'd value this group's view as well: https://datatracker.ietf.org/doc/draft-le-agent-passport/ <https://www.google.com/url?q=https://datatracker.ietf.org/doc/draft-le-agent-passport/&source=gmail&ust=1794015502817000&sa=E>
*In short*, it defines two signed objects for AI agents: - an *Agent Passport*, a JWT binding an agent's key (cnf) to the organisation accountable for it and to a digest of its build (model, configuration, tools); - *Delegation Receipts*, a chain from a user through agents and sub-agents. Each step is key-bound and can only narrow the one before, and the relying party verifies the whole chain and intersects it with the user's own access. *The OAuth-specific parts:* - Root receipts are issued through *Token Exchange (RFC 8693)*, with the passport as the actor token and a new requested_token_type, urn:ietf:params:oauth:token-type:agent-delegation (Section 5.4). - Passports and receipts carry status using the *Token Status List* draft (Section 7). - An open question (Appendix B) is whether grants should be expressed as an *RFC 9396 authorization_details* type, so that authorisation servers already supporting RAR can issue root receipts directly. Opinions welcome. It's meant to complement draft-klrc-aiagent-auth and AAuth rather than compete with them. Section 1.1 covers what it adds: build binding, attenuation the relying party can verify across organisations, and controller accountability. *The -01 direction so far*, from review on the WIMSE list, is fail-closed revocation, bounded controller-document caching, explicit transport requirements, and attested builds with pinned digests. *Side meeting at IETF 127:* Tuesday, 17 November, 18:45–19:45 PT, Plaza A, with remote participation via sidemeetings.ietf.org <https://www.google.com/url?q=https://sidemeetings.ietf.org/&source=gmail&ust=1794015502818000&sa=E>. OAuth folks are very welcome. An IPR disclosure with a royalty-free licensing declaration has been filed. Ben Le Redthread Security
_______________________________________________ OAuth mailing list -- [email protected] To unsubscribe send an email to [email protected]
