IETF Logo Mail Archive

[OAUTH-WG] Overlap of AI related proposals

george@practicalidentity.com Mon, 16 March 2026 12:56 UTC

Return-Path: <george@practicalidentity.com>
X-Original-To: oauth@mail2.ietf.org
Delivered-To: oauth@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id ABA31CB4FB83 for <oauth@mail2.ietf.org>; Mon, 16 Mar 2026 05:56:07 -0700 (PDT)
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -0.751
X-Spam-Level:
X-Spam-Status: No, score=-0.751 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_BL_SPAMCOP_NET=1.347, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=practicalidentity.com
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id s450Mb7RQA_y for <oauth@mail2.ietf.org>; Mon, 16 Mar 2026 05:56:06 -0700 (PDT)
Received: from outbound.qs.icloud.com (qs-2007g-snip4-8.eps.apple.com [57.103.84.199]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id 94906CB4FB7E for <oauth@ietf.org>; Mon, 16 Mar 2026 05:56:06 -0700 (PDT)
Received: from outbound.qs.icloud.com (unknown [127.0.0.2]) by p00-icloudmta-asmtp-us-east-2d-10-percent-2 (Postfix) with ESMTPS id EED9230000AE for <oauth@ietf.org>; Mon, 16 Mar 2026 12:55:59 +0000 (UTC)
Dkim-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=practicalidentity.com; s=sig1; t=1773665760; x=1776257760; bh=sYcyP1aowaZpJrA/vjNNE6zHpXuGtC9+TNiYAA8Q2Ds=; h=From:Content-Type:Mime-Version:Subject:Message-Id:Date:To:x-icloud-hme; b=vGUriVgh8olnLaDJ/Qc6xSuwFAGJO8YtDHfRIxLs4nGljEOIMjAz6vS3ZYDyI0hV6P7K7P/0cmJcI4T+6NJjqUqAh2Q3QOmvCJo0dtXb5w+Dtt9LVkhS9jyIOgOiNzNgxdkF/QsvFef0wBCdYenMas13mD2dpI1IR/LTovoYpZi5Aiz96xLO/h47/lEMgetS2sj5BH8gc+fd+UOxqkV8DLAG8DWKXg/qXuvWKUaVM4hS09G8k78iC8w4NKnvBGXaQcv1MaEPui3xtYMwWSdUWDJPcmVWHi5evisE6GgaPveQJn3B9gkcJ66uKfREg1fbLOE93o2PQkpa2OIpVxkqnQ==
mail-alias-created-date: 1727343745928
Received: from smtpclient.apple (unknown [17.57.155.37]) by p00-icloudmta-asmtp-us-east-2d-10-percent-2 (Postfix) with ESMTPSA id 68A2130000AF for <oauth@ietf.org>; Mon, 16 Mar 2026 12:55:59 +0000 (UTC)
From: george@practicalidentity.com
Content-Type: multipart/alternative; boundary="Apple-Mail=_C4393D6F-A6A6-4A7A-9880-08D3C10CD10A"
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3864.400.21\))
Message-Id: <5439A546-7D50-40F6-8697-B85133C7EEC3@practicalidentity.com>
Date: Mon, 16 Mar 2026 08:55:48 -0400
To: oauth <oauth@ietf.org>
X-Mailer: Apple Mail (2.3864.400.21)
X-Authority-Info-Out: v=2.4 cv=Z8Lh3XRA c=1 sm=1 tr=0 ts=69b7fde0 cx=c_apl:c_pps:t_out a=bsP7O+dXZ5uKcj+dsLqiMw==:117 a=bsP7O+dXZ5uKcj+dsLqiMw==:17 a=Yq5XynenixoA:10 a=VkNPw1HP01LnGYTKEx00:22 a=2l6mIrwm1DP1SSNaLtgA:9 a=QEXdDO2ut3YA:10 a=ZBvT17070DJQ-6HW:21 a=_W_S_7VecoQA:10
X-Proofpoint-GUID: 593SnDGs6nojIELc3IDv1-ykG14fodND
X-Proofpoint-ORIG-GUID: 593SnDGs6nojIELc3IDv1-ykG14fodND
X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwMzE2MDA5NyBTYWx0ZWRfX/u8FXLvPz5XA xoAR4tGy3OvWObw70SDRLqq8ONWUg6Yhes/EesHZOJcL21/37CWKtCBmYalG0xIH4fdFDrFy12z i1JUfjjt6Osw5JuUrNjFTf1hojnsUK7ed0igyo7+KcWb5y8LPYDzYLbjjnWjyPxYJhWHHrTt1qQ 4UL8CJ3Mdn/knW/GOi4ESOoF4N3FMx4o9Ufw+E+3iJlmsWA48knwv2kN3+ZrYfrqib/STzL0KPU p7WNgmp635RpvJR/mKOQj80prDGk/CEzZrlDjsrq4NcQ7w33MCMWwSX2cmZUgzr/IRwSaPDOa9w jZuw5+w2UTsdOlxaUZFEkjxAY1J4hInRHNvX3067LzhAek9ZrcYk6dz9I7TgVg=
X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.51,FMLib:17.12.100.49 definitions=2026-03-16_04,2026-03-16_03,2025-10-01_01
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 mlxlogscore=716 mlxscore=0 spamscore=0 phishscore=0 lowpriorityscore=0 clxscore=1030 suspectscore=0 malwarescore=0 bulkscore=0 adultscore=0 classifier=spam authscore=0 adjust=0 reason=mlx scancount=1 engine=8.22.0-2601150000 definitions=main-2603160097
X-JNJ: AAAAAAABPvU0SVSFqcnDmfLsPWqtQ+IqqvI+jofq5pa4sGIo9LZ13M390B1bhTrvLPirGOpNrmVNlMfXa3ILxuSnmwnCNTCUEoB0aES5VK+5P/lpiZqox4jUc7U3GrXxoF2bQ873/B5pZd+aGhY88+3DSrohBNa9h3GAQIY8r+6g6NOjvA833QepzRYkjeOd4JPzbPdBAzRwGN8i8kv6kygW5Se2vKeMsAQpnJbzNuZYKUiKXtVTmnL6oczfHZH/BkR9XGJA9m71SMlaDwgq4HaQd1WNh4TCd9ucLwIS2sjuugJko+WF/dij6ZM3N8Mp/+ll/NulM6ZhRLuQB64CWKFwQs8YSyhU1lCXrqVMn9z7493OgTXHbSGUlGdc17Y8Vym6oJUn6Kt9EAvJWJ2UHQaX0P3ReEwI2wPaTk8kavmC7Kq3H8IVDvXp/W7W8jZs/a3KgR3StC1Iidokw4P0pEktExGTkERZiwbTj9SRhnznZFu47jRZPpZCvaJ55bDnuUbkMp/QYqzTeWqDrFKZIe01ttj46zA2+6dSRyNbtLtd2MDnSje6s9Ol0eoXrfRI2dvH4IC6
Message-ID-Hash: KSM4BCSQNDYAZYGWJWAGOCTBUQFENFVE
X-Message-ID-Hash: KSM4BCSQNDYAZYGWJWAGOCTBUQFENFVE
X-MailFrom: george@practicalidentity.com
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-oauth.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [OAUTH-WG] Overlap of AI related proposals
List-Id: OAUTH WG <oauth.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/kTZebhF8tTiYWlt8EH0a-LC420Y>
List-Archive: <https://mailarchive.ietf.org/arch/browse/oauth>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Owner: <mailto:oauth-owner@ietf.org>
List-Post: <mailto:oauth@ietf.org>
List-Subscribe: <mailto:oauth-join@ietf.org>
List-Unsubscribe: <mailto:oauth-leave@ietf.org>

On Monday at the OAuth meeting for IETF 125 a number of AI related proposals were made to extend existing OAuth mechanisms in different ways. However, it seemed to me that there was overlap in the desired goals across these proposals and I’m wondering if for the AI space we need to take a step back and define the desired requirements before making spec level proposals. Just in what was presented, there is fragmentations and this doesn’t include a number of other proposals that have been made (either to IETF or otherwise) but were not presented.

General topics that seem to come up frequently:
* identifiers - instance, owner, version, …
* fine-grained authorization - RAR, scope extensions, transaction tokens, …
* delegated authorization - delegation chain, delegation capabilities, on-behalf-of, for-the-benefit-of, …
* context & intent - transformation of original intent for specific delegation task, ...
* consent - levels of delegation before consent is required, back channel consent, …
* privacy - 

I’m sure there are more. I know it takes more time, but I believe we should address these issues holistically rather than on a spec by spec basis.

Thanks,
George

George Fletcher
Identity Standards Architect
Practical Identity LLC

v2.46.0 | Report a Bug | By Email | System Status