[OAUTH-WG] Re: [WIMSE] Re: Re: Binding OAuth-authorized calls to specific tool-call arguments in agentic/MCP flows

[Iman Schrock <[e-mail]>]

Hi Sangam,

I can offer the EMILIA reference profile for that comparison. We shared it
on the AuthZEN list, and the runnable version is pinned here:

https://github.com/emiliaprotocol/emilia-protocol/tree/fd8378671ab863a47f35e18503e5ab1929ae2fcd/conformance/composition/authzen-coaz-mcp-aeb-v0.1

The executor checks the full action against a separately signed
expected-action record pinned by its owner. It reserves one attempt before
entering the provider callback. A changed beneficiary is refused before
that entry, even when the toy PDP returns the same coarse allow.

After entry, a timeout leaves the reservation unresolved. Reconciliation
verifies signed evidence for the original provider and action; it cannot
invoke execution again. The admission check therefore happens before
dispatch.

This is a single-live-instance harness. It does not establish durable
custody across restarts or prove that a deployment has no bypass. It uses a
toy PDP and test keys, and is an EMILIA proposal, not an adopted AuthZEN
profile. The README includes the commands to rerun the cases.

Best,
Iman