[OAUTH-WG] Re: [WIMSE] Re: OAuth IETF 127 Call for Agenda Items

[Ashay Raut <[e-mail]>]

I had separately also emailed about Transaction token for agents draft too.

Sharing it here -

I would like to request agenda time at the upcoming IETF 127 meeting (under
the OAuth WG or relevant tracks like WIMSE) to present and discuss two
related drafts:

1. draft-araut-oauth-transaction-tokens-for-agents-02

https://www.ietf.org/archive/id/draft-araut-oauth-transaction-tokens-for-agents-02.html

2. draft-oauth-transactiontokens-bcp-01
   https://www.ietf.org/archive/id/draft-oauth-transactiontokens-bcp-01.html


### Core Problem & Proposal
Modern service-oriented architectures and multi-agent AI ecosystems
struggle with context-aware authorization, dynamic delegation, and
maintaining end-to-end auditability across deep call chains.

These drafts address these gaps by defining how to pass agentic context as
a first-class claim inside transaction tokens. This mechanism directly
enables zero trust, fine-grained observability, and clear accountability
across heterogeneous microservices and AI agent boundaries.

### Industry Adoption & Real-World Validation
* Production Scale at Amazon: Amazon currently issues 500 billion
transaction tokens equivalent per day utilizing these underlying
architectural concepts. As the one of the top active draft originating from
Amazon in this area, sharing this operational experience with the broader
community aims to help establish a unified open standard.
* Broader Ecosystem Traction:
  - Revi AI has implemented this model.
  - Industry leaders are actively building around it (e.g., Sean O'Dell at
CVS published their end-to-end agentic security strategy explicitly citing
this draft).


Regards,
Ashay Raut

On Thu, Oct 15, 2026 at 2:18 AM Atul Tulshibagwale <atul.tulshibagwale=
[e-mail]> wrote:

> Hi Rifaat,
> On a related note, I'd like to discuss the Transactional Access Tokens
> <https://www.ietf.org/archive/id/draft-tulshi-oauth-transactional-access-tokens-00.html>
> proposal too. It relates to the work George, Pieter, and Sean are doing.
>
> Thanks,
> Atul
>
> On Wed, Oct 7, 2026 at 7:32 AM <[e-mail]> wrote:
>
>> I would like to talk about using transaction tokens to cross trust domain
>> boundaries in the WIMSE/OAuth joint session. This is a key capability for
>> organizations deploying transaction tokens and a resource server downstream
>> in the chain needing to invoke a service in a different trust domain. The
>> current version of the individual draft can be found here:
>>
>> [datatracker.ietf.org]Transaction Token Authorization Grant Profile for
>> OAuth Identity and Authorization Chaining [datatracker.ietf.org]
>> <https://urldefense.com/v3/__https://datatracker.ietf.org/doc/draft-fletcher-transaction-token-chaining-profile/__;!!BmdzS3_lV9HdKG8!z_CRAwMnx8qIzsNsxnn1Qmkfjn40wrqfkcf0EZxgqeQswXF4zXvWkodF0gjH2hgPV-pVsBNlvnGUD_p_Zpc$>
>> datatracker.ietf.org [datatracker.ietf.org]
>> <https://urldefense.com/v3/__https://datatracker.ietf.org/doc/draft-fletcher-transaction-token-chaining-profile/__;!!BmdzS3_lV9HdKG8!z_CRAwMnx8qIzsNsxnn1Qmkfjn40wrqfkcf0EZxgqeQswXF4zXvWkodF0gjH2hgPV-pVsBNlvnGUD_p_Zpc$>
>> [image: ietf-logo-nor-180.png] [datatracker.ietf.org]
>> <https://urldefense.com/v3/__https://datatracker.ietf.org/doc/draft-fletcher-transaction-token-chaining-profile/__;!!BmdzS3_lV9HdKG8!z_CRAwMnx8qIzsNsxnn1Qmkfjn40wrqfkcf0EZxgqeQswXF4zXvWkodF0gjH2hgPV-pVsBNlvnGUD_p_Zpc$>
>> <https://urldefense.com/v3/__https://datatracker.ietf.org/doc/draft-fletcher-transaction-token-chaining-profile/__;!!BmdzS3_lV9HdKG8!z_CRAwMnx8qIzsNsxnn1Qmkfjn40wrqfkcf0EZxgqeQswXF4zXvWkodF0gjH2hgPV-pVsBNlvnGUD_p_Zpc$>
>>
>> The authors will be publishing an update before IETF 127.
>>
>> Thanks,
>> George
>>
>> --
>> George Fletcher
>> Practical Identity LLC
>>
>> On Oct 6, 2026, at 1:54 PM, Rifaat Shekh-Yusef <[e-mail]>
>> wrote:
>>
>> 
>> All,
>>
>> The OAuth working group chairs have requested *2 two-hour* meeting slots
>> on the agenda for *IETF 127 *in San Francisco.
>>
>> In addition, as the intersection between the work of the WIMSE and OAuth
>> working groups becomes increasingly important,
>> the chairs of both groups have requested an *additional two-hour joint
>> session* dedicated to topics that touch both groups.
>> For example, transaction tokens are defined as OAuth artifacts but relate
>> directly to workload security.
>>
>> At this time the OAuth chairs are soliciting proposals for both the
>> dedicated OAuth sessions and the joint WIMSE/OAuth session.
>> Please send your requests to the mailing list or directly to the chairs,
>> indicating whether your request is for the OAuth session,
>> the joint session, or could fit in either session.
>>
>> *Current working group items and proposals with demonstrated interest
>> from multiple different parties will get priority.*
>>
>> Please note that the Internet-Draft submission cut-off is Monday, 2
>> November 2026 at 23:59 UTC [1].
>> Please ensure that new drafts and updates to existing drafts are
>> published in Datatracker before the deadline.
>>
>> Regards,
>>  Rifaat and Hannes
>>
>> [1] https://datatracker.ietf.org/meeting/important-dates/
>> [datatracker.ietf.org]
>> <https://urldefense.com/v3/__https://datatracker.ietf.org/meeting/important-dates/__;!!BmdzS3_lV9HdKG8!z_CRAwMnx8qIzsNsxnn1Qmkfjn40wrqfkcf0EZxgqeQswXF4zXvWkodF0gjH2hgPV-pVsBNlvnGUCXWrCi0$>
>>
>> _______________________________________________
>> OAuth mailing list -- [e-mail]
>> To unsubscribe send an email to [e-mail]
>>
>> _______________________________________________
>> WIMSE mailing list -- [e-mail]
>> To unsubscribe send an email to [e-mail]
>>
> _______________________________________________
> WIMSE mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
>