[OAUTH-WG] draft-watts-oauth-agent-revocation-closure-02: closure semantics for delegated agent authority
DW <deonte.wattss@gmail.com> Thu, 15 October 2026 19:12 UTC
Received: from mail-yx1-xb12f.google.com (mail-yx1-xb12f.google.com [IPv6:2607:f8b0:4864:20::b12f]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by mx.ietf.org (Postfix) with ESMTPS id 0D27446 for <oauth@ietf.org>; Thu, 15 Oct 2026 19:12:16 +0000 (UTC)
Authentication-Results: mx.ietf.org; dkim=pass header.d=gmail.com header.s=20251104 header.b=e51VPTgF; arc=pass ("google.com:s=arc-20260327:i=1"); spf=pass (mx.ietf.org: domain of deonte.wattss@gmail.com designates 2607:f8b0:4864:20::b12f as permitted sender) smtp.mailfrom=deonte.wattss@gmail.com; dmarc=pass (policy=none) header.from=gmail.com
Received: by mail-yx1-xb12f.google.com with SMTP id 956f58d0204a3-677dbe051d4so2022400d50.0 for <oauth@ietf.org>; Thu, 15 Oct 2026 12:12:16 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1792091535; cv=none; d=google.com; s=arc-20260327; b=kX2LaVRxJJLTI/0wx7NKpwgonVmpnMF6iWRnD07Z8cjinz9si7IQ/pMZcbt+sVff+G 0VtduFiU3jdkkzofMMSKc9BI2SSOSF3PczjmL08pRsDqwjYelOw0BNvN2tkc4uWs57G0 INHu69d01UhjnzLIbmnxUV20LhGSrWs6glQ5Cta6WB6kbfpJOkPMUc3vAwUA2XSLBwKS gsdlsDT+1RDqsSDK9Xg6cTGEP2cnnocX2oeWxaHQQeNIDBph9ANIdVCsptJLHvUxxfjc fez+T573JAoLxf7i7EGz8awV9iaQZFL8FfL4fr3CWgzyGzK/kGxs/hs/gFlLpb9u13gX xJtQ==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=to:subject:message-id:date:from:mime-version:dkim-signature; bh=6riM5jxS5y6hkcNyBmCHSVrgo8GbsgMYRQbTjqu+E5Q=; fh=HRwJNtTTtPgtfgvXyPaPq+Te1JrkxlJZMfmgN30AIzQ=; b=dolJqjhe5Mk0HWf9bqD8nj3fAhVLg8RtMYvgsscw1q9g/mNNMrZu1OyRSHH2wcTvTO JLTk59lPkZZBzLsneu8lizcJxmpJbQSeBuT2FYdQcGQqPsSQK7drUH1nYqSk6w9aFX1B jPuZ3bzdCUU0Nkm/QnkJFczfEPcEQETrkrxe3B0xVHfxcLWGqAaxDzf4s/SIOAOIzQ9X WKhzd+BASkaSvM+7kvnNI3tB106NRFowA8y616R9e4fQc8ycHxO5MYTdmaNqO3PT9IXW f1CAndO85NeU7eVbA2I9VXZ+6AjxQK17c5IgTxqarSZ70LwWXhogV68/sTweH1BRBkOp INYg==; darn=ietf.org
ARC-Authentication-Results: i=1; mx.google.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792091535; x=1792696335; darn=ietf.org; h=content-type:to:subject:message-id:date:from:mime-version:from:to :cc:subject:date:message-id:reply-to:content-type; bh=6riM5jxS5y6hkcNyBmCHSVrgo8GbsgMYRQbTjqu+E5Q=; b=e51VPTgFuTjIOkkkvNhSTmt99u2G5JxW5S9gVTlyDnpDqTGXaSHMcfo2wuqRV1P2hQ /NJqovtaTpqXLF/RC3VnKXO9A0HmdDlQDJXtx4MKoeqKsxLzavKNMHpO9ZZ241/Apfaq vPri8hRp/foasaVzIayxEPS8rFT9Xr/ZeU0uGUC1lHs4j9xGieK+U11y1ycwQRdVnaTn pIblxmKe/44b1ePtDWMZ3f/+rxnOiDrlYV1wZ2/781S2vVY/OMPjolO6nlFeO1mmCk1s XM/64dXZGHXx7f3IcOPEjLrMAh3a9zyuDW7oWEx/uMTntH3wctAz/WzzshJVu6nJA2AF feww==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792091535; x=1792696335; h=content-type:to:subject:message-id:date:from:mime-version:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=6riM5jxS5y6hkcNyBmCHSVrgo8GbsgMYRQbTjqu+E5Q=; b=onJTqS9TUS0MA3HQBEc2y3Pi1zLk/gwqOGVbRHwf8m5wIkO/GMzFFdr57dXE25LRNl epA165xzfX0EQAVBPsZ4bhqlwa6VplHNk7clo6saLmGawKYlrGpEzz5zTjLUoIwBrUxy aHELPRjUKMcQbyYoM0YSHoQZd/K+2LdBktOvoYHQdH1mwO62GpXOkg4rpEXqhvHNNBfd hCx/1YI8zvIdJtcUgbNNsYCiORmYhMyvAn0HMg/ED78rgs99ypouG/o5AsKLLKd0oR0H QbFVEeozPmPWp6lsHlOvttGq4Hsg1genI7sGkRbK44789PqkxK59YdR16YYrU0QjEd1n Sr1Q==
X-Gm-Message-State: AFq9FYIWwBc+lAFyXCsQLcR/KEGs/zVkRxdQwy9HEFV10Nw+VM0OVBb8 R8YNM1ZES+eSOHlTuUKKm7swZdhLd/RQOHRB54UXMWiGOiw2c4NPh1G4110g0Jmjndpnzs09R4O dqeg95uIOIqPS1HsKHFsrklgPkyQh7Pf8Kw==
X-Gm-Gg: AYBFou38VO88qwqfrrsTsjwVsk8PL445f6RMj66ezb79E/WdyocOG7Ac+6XkNYOke50 HZwCvtaQxvt+PzeLy4KXXA6hipPqqo3cK0q2/mmLSVtXM+zcelH9GK6PtjFZQBaZdZDUais+t59 xp5xgVnbq2IIwavvT3WzFoxThafWavqfXswYdkUjNt2R6MzRMfMrOPMwSFsnbbsstL1xag3i3pX BWsHLlmaAtfo+WT2JGP/WVPMHl/7+B56Cwr+SC3bK7dg4eV6WeK3pqsvbGThdN38pfhzY0bDE15 vnZLmIDcQ4LI6N6BqbkFFvar+E7/GzZPomYD+1Wl+LftYnDNk80qHA==
X-Received: by 2002:a05:690e:4391:b0:673:759d:b71d with SMTP id 956f58d0204a3-67935edca3emr3439986d50.5.1792091535299; Thu, 15 Oct 2026 12:12:15 -0700 (PDT)
Received: from 77377267392 named unknown by gmailapi.google.com with HTTPREST; Thu, 15 Oct 2026 14:12:14 -0500
Received: from 77377267392 named unknown by gmailapi.google.com with HTTPREST; Thu, 15 Oct 2026 14:12:14 -0500
MIME-Version: 1.0
From: DW <deonte.wattss@gmail.com>
Date: Thu, 15 Oct 2026 14:12:14 -0500
X-Gm-Features: AclHuK_Rtv0dBsUR3YQg1tdJKPjnsjzWb5D2bCZjG2CrEHyodrS6-nWA0t17Ftk
Message-ID: <CAKKZaR01nMDmdJHMv_uWw=rhmEEfAX9OQUwQtNc9nAJ8H4mg2A@mail.gmail.com>
To: oauth@ietf.org
Content-Type: text/plain; charset="UTF-8"
X-Spamd-Bar: ---------------------
Message-ID-Hash: GMVKDBDVCDTM4DG3HSO7BXURFVQUI6L6
X-Message-ID-Hash: GMVKDBDVCDTM4DG3HSO7BXURFVQUI6L6
X-MailFrom: deonte.wattss@gmail.com
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-oauth.ietf.org-0; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
X-Mailman-Version: 3.3.10
Precedence: list
Subject: [OAUTH-WG] draft-watts-oauth-agent-revocation-closure-02: closure semantics for delegated agent authority
List-Id: OAUTH WG <oauth.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/VElrXkoa3mN54Sl1Dv9QEAHknio>
List-Archive: <https://mailarchive.ietf.org/arch/browse/oauth>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Owner: <mailto:oauth-owner@ietf.org>
List-Post: <mailto:oauth@ietf.org>
List-Subscribe: <mailto:oauth-join@ietf.org>
List-Unsubscribe: <mailto:oauth-leave@ietf.org>
Hello OAuth WG, I have prepared revision -02 of "Revocation Closure and Authority Epochs for Agent Delegation" for feedback. The revision is currently being processed in the Datatracker. The draft addresses a narrow gap in complex delegation: an RFC 7009-style token or grant invalidation does not by itself establish that all authority derived from that authorization can no longer cause a new consequential effect. In agent and multi-workload systems, exchanged tokens, delegated children, cached decisions, and queued or delayed work can survive the invalidation event. The draft therefore separates: revocation request != token/grant invalidation != delegated-authority closure and defines scoped authority epochs, delegation lineage, admission/queue fencing, and CLOSED/PARTIAL/FAILED/UNKNOWN semantics. UNKNOWN is never promoted to CLOSED. The profile composes with RFC 7009, RFC 8693, RFC 7662, DPoP, Transaction Tokens, and WIMSE/AIMS; it defines no new grant type, token format, endpoint, or IANA registry. The document page is: https://datatracker.ietf.org/doc/draft-watts-oauth-agent-revocation-closure/ I would appreciate feedback on whether this closure semantic belongs as OAuth WG work, should be folded into adjacent agent-revocation/delegation work, or needs further narrowing before adoption discussion. Best, Deonte O'dell Watts ORCID: https://orcid.org/0009-0005-8586-3650