[OAUTH-WG] Re-introducing draft-araut-oauth-transaction-tokens-for-agents-02 – Agentic Context Propagation

["Raut, Ashay" <[e-mail]>]

Hi OAuth Working Group,

I am writing to draw attention back to draft-araut-oauth-transaction-tokens-for-agents-02<https://www.ietf.org/archive/id/draft-araut-oauth-transaction-tokens-for-agents-02.html> [1] and share some recent industry momentum around this problem space. I am Principal Engineer in Amazon focused on securing agentic workloads in Amazon Stores.

As multi-agent flows and autonomous workloads become standard across enterprises, propagation of granular, verifiable agent context across transaction chains has emerged as a key operational and security challenge. Building directly on the base Transaction Tokens framework (draft-ietf-oauth-transaction-tokens), this extension formalizes how agent identity (act, sub) and chain-level context (agentic_ctx, hop tracking, assurance level attenuation) are propagated and updated across microservice call graphs.

Over the past few months, interest in this specification has grown across engineers from both startups and large enterprises including Reva AI, CVS, Broadcom, Uber, and others who are actively looking into or evaluating this approach to solve identity propagation for agentic AI workloads.

With the -02 revision published, I’d like to reopen discussion with the working group to gather feedback on the draft and next steps for adopting or refining this profile within the WG.

I welcome any feedback, questions, or reviews on the draft. You can also open issue at https://github.com/ashayraut/oauth-transactiontokens-for-agents/issues

Best regards,

Ashay Raut

Datatracker: https://datatracker.ietf.org/doc/draft-araut-oauth-transaction-tokens-for-agents<https://datatracker.ietf.org/doc/draft-araut-oauth-transaction-tokens-for-agents/>