--- type: Agentic Web Standard title: "Identity Assertion JWT Authorization Grant (ID-JAG)" description: "How can an app or AI agent, already SSO-federated to a user's enterprise identity provider, obtain scoped access to a third-party API or MCP server without a fresh consent screen at that third party?" resource: "https://datatracker.ietf.org/doc/draft-ietf-oauth-identity-assertion-authz-grant/" tags: ["permit", "endpoint", "ietf", "delegate-user-authority", "prove-agent-identity", "expose-tools-to-agents"] status: draft generated: { by: agenticweb-builder/1.0, at: 2026-10-30T00:00:00Z } verified: { by: process:agenticweb-engine, at: 2026-10-29T00:00:00Z } stale_after: 2026-11-28T00:00:00Z sources: - id: ref-1 resource: "https://datatracker.ietf.org/doc/draft-ietf-oauth-identity-assertion-authz-grant/" title: "IETF Datatracker, draft-ietf-oauth-identity-assertion-authz-grant-04 - Identity Assertion JWT Authorization Grant (document page), checked 2026-10-29: \"Intended RFC status (None)\" \"WG state WG Document\" \"IESG state I-D Exists\" \"Replaces draft-parecki-oauth-identity-assertion-authz-grant\"" last_modified: 2026-10-29T00:00:00Z - id: ref-2 resource: "https://www.ietf.org/archive/id/draft-ietf-oauth-identity-assertion-authz-grant-04.html" title: "A. Parecki (Okta), K. McGuinness (Independent), B. Campbell (Ping Identity), Identity Assertion JWT Authorization Grant, draft-ietf-oauth-identity-assertion-authz-grant-04 (Internet-Draft, HTML), 2026-05-21, checked 2026-10-29: \"Workgroup: Web Authorization Protocol Internet-Draft: draft-ietf-oauth-identity-assertion-authz-grant-04 Published: 21 May 2026 Intended Status: Standards Track Expires: 22 November 2026 Authors: A. Parecki Okta K. McGuinness Independent B. Campbell Ping Identity\" \"This Internet-Draft will expire on 22 November 2026.\" \"This specification provides a mechanism for an application to use an identity assertion to obtain an access token for a third-party API by coordinating through an identity provider that the downstream Resource Authorization Server already trusts for single sign-on (SSO), using Token Exchange [RFC8693] and JWT Profile for OAuth 2.0 Authorization Grants [RFC7523].\" \"This pattern is informally referred to as Cross-App Access (XAA).\" \"The Resource Authorization Server still applies local policy to decide whether to honor the grant, whether to narrow or reject the requested access, and what access token to issue.\" \"The typ of the JWT indicated in the JWT header MUST be oauth-id-jag+jwt.\" \"identity_chaining_requested_token_types_supported indicates which token types an IdP Authorization Server can issue for identity chaining, while authorization_grant_profiles_supported indicates which authorization grant profiles a Resource Authorization Server can process.\" \"To advertise support for issuing an Identity Assertion JWT Authorization Grant via Token Exchange, the IdP Authorization Server SHOULD include the following value in identity_chaining_requested_token_types_supported:\" \"To advertise support for the Identity Assertion JWT Authorization Grant profile, the Resource Authorization Server SHOULD include the following value in the authorization_grant_profiles_supported property:\" \"A Resource Authorization Server that includes urn:ietf:params:oauth:grant-profile:id-jag in authorization_grant_profiles_supported for this specification MUST also include urn:ietf:params:oauth:grant-type:jwt-bearer in grant_types_supported.\" \"Inclusion of a profile identifier in authorization_grant_profiles_supported indicates only that the Resource Authorization Server implements the processing rules for that profile. It does not indicate that any particular issuer, tenant, client, subject, audience, or authorization request will be accepted.\" \"Resource Authorization Servers MUST NOT use authorization_grant_profiles_supported to disclose issuer allow lists or other profile-specific trust relationships.\" \"Resource Authorization Servers MAY provide a protected discovery mechanism by which an authenticated client can determine whether an Identity Assertion JWT Authorization Grant from a particular issuer would be accepted for that client.\" \"If the urn:ietf:params:oauth:grant-profile:id-jag authorization grant profile is supported, the AI Agent can first attempt to silently obtain an access token using an Identity Assertion JWT Authorization Grant from the IdP Authorization Server trusted by the External Tool Resource Authorization Server for SSO\" \"This section registers oauth-id-jag+jwt, a new media type [RFC2046] in the \"Media Types\" registry\" \"This section registers urn:ietf:params:oauth:token-type:id-jag in the \"OAuth URI\" subregistry\" \"A.3. Email and Calendaring Applications A.3.1. Preconditions A.4. AI Agent using External Tools\"" last_modified: 2026-05-21T00:00:00Z - id: ref-3 resource: "https://datatracker.ietf.org/api/v1/doc/document/draft-ietf-oauth-identity-assertion-authz-grant/" title: "IETF Datatracker, API, document record for draft-ietf-oauth-identity-assertion-authz-grant (JSON; times UTC), checked 2026-10-29: \"expires\": \"2026-11-22T22:18:28Z\"" last_modified: 2026-10-29T00:00:00Z - id: ref-4 resource: "https://datatracker.ietf.org/api/v1/doc/newrevisiondocevent/?doc__name=draft-ietf-oauth-identity-assertion-authz-grant&limit=20" title: "IETF Datatracker, API, new-revision events for draft-ietf-oauth-identity-assertion-authz-grant (JSON; times UTC), checked 2026-10-29: \"rev\": \"00\", \"time\": \"2025-09-08T21:11:46Z\" \"rev\": \"01\", \"time\": \"2025-10-19T19:41:50Z\" \"rev\": \"02\", \"time\": \"2026-03-02T20:10:50Z\" \"rev\": \"03\", \"time\": \"2026-04-22T22:16:37Z\" \"rev\": \"04\", \"time\": \"2026-05-21T22:18:28Z\"" last_modified: 2026-10-29T00:00:00Z - id: ref-5 resource: "https://datatracker.ietf.org/api/v1/doc/newrevisiondocevent/?doc__name=draft-parecki-oauth-identity-assertion-authz-grant&limit=20" title: "IETF Datatracker, API, new-revision events for the individual draft-parecki-oauth-identity-assertion-authz-grant (JSON; times UTC), checked 2026-10-29: \"rev\": \"00\", \"time\": \"2024-03-02T01:23:02Z\" \"rev\": \"05\", \"time\": \"2025-07-02T23:20:43Z\"" last_modified: 2026-10-29T00:00:00Z - id: ref-6 resource: "https://www.iana.org/assignments/oauth-parameters" title: "IANA, OAuth Parameters (registry page; scanned for the draft's requested entries, none present), checked 2026-10-29" last_modified: 2026-10-29T00:00:00Z - id: ref-7 resource: "https://api.github.com/repos/oauth-wg/oauth-identity-assertion-authz-grant/pulls?state=open&per_page=50" title: "GitHub REST API, oauth-wg/oauth-identity-assertion-authz-grant open pull requests (JSON; times UTC), checked 2026-10-29: \"title\": \"Specify how the Resource Authorization Server finds ID-JAG signing keys\" \"title\": \"Allow IdP to accept its own ID-JAGs when explicitly configured\"" last_modified: 2026-10-29T00:00:00Z - id: ref-8 resource: "https://api.github.com/repos/oauth-wg/oauth-identity-assertion-authz-grant/commits?per_page=10" title: "GitHub REST API, oauth-wg/oauth-identity-assertion-authz-grant recent commits on the default branch (JSON; times UTC), checked 2026-10-29: \"message\": \"update changelog\"" last_modified: 2026-10-29T00:00:00Z - id: ref-9 resource: "https://datatracker.ietf.org/doc/draft-ietf-oauth-identity-chaining/" title: "IETF Datatracker, draft-ietf-oauth-identity-chaining-17 - OAuth Identity and Authorization Chaining Across Domains (document page), checked 2026-10-29: \"Intended RFC status Proposed Standard\" \"IESG state RFC Ed Queue\"" last_modified: 2026-10-29T00:00:00Z - id: ref-10 resource: "https://modelcontextprotocol.io/extensions/auth/enterprise-managed-authorization" title: "Model Context Protocol, Enterprise-Managed Authorization - Model Context Protocol (extension overview, undated page), checked 2026-10-29: \"The Enterprise-Managed Authorization extension (io.modelcontextprotocol/enterprise-managed-authorization) enables organizations to control MCP server access centrally through their existing identity provider (IdP).\" \"The MCP Client requests a special type of token from the enterprise IdP called an Identity Assertion JWT Authorization Grant, or ID-JAG.\" \"Extensions are opt-in and never active by default.\"" last_modified: 2026-10-29T00:00:00Z - id: ref-11 resource: "https://raw.githubusercontent.com/modelcontextprotocol/ext-auth/main/specification/stable/enterprise-managed-authorization/2026-07-28/enterprise-managed-authorization.mdx" title: "Model Context Protocol, ext-auth repository, Enterprise-Managed Authorization specification, protocol revision 2026-07-28 (raw Markdown), checked 2026-10-29: \"This document specifies how an MCP Client can obtain an access token from an MCP Server's authorization server by presenting an identity assertion it previously obtained from an enterprise Identity Provider during single sign-on\" \"Protocol Revision: 2026-07-28\"" last_modified: 2026-07-28T00:00:00Z - id: ref-12 resource: "https://blog.modelcontextprotocol.io/posts/enterprise-managed-auth/" title: "Model Context Protocol Blog, Enterprise-Managed Authorization: Zero-touch OAuth for MCP, 2026-06-18, checked 2026-10-29: \"The Enterprise-Managed Authorization extension is now stable.\" \"Okta is the first supported identity provider.\" \"Anthropic has implemented the extension in its shared MCP layer for Claude. Admins can authorize MCP servers for users across Claude, Claude Code, and Cowork.\" \"Servers: Asana, Atlassian, Canva, Figma, Granola, Linear and Supabase now support EMA, with Slack and more actively adding support.\"" last_modified: 2026-06-18T00:00:00Z - id: ref-13 resource: "https://modelcontextprotocol.io/seps/990-enable-enterprise-idp-policy-controls-during-mcp-o" title: "Model Context Protocol, SEP-990: Enable enterprise IdP policy controls during MCP OAuth flows (SEP page), checked 2026-10-29: \"Status Final Type Standards Track Created 2025-06-04\"" last_modified: 2025-06-04T00:00:00Z - id: ref-14 resource: "https://modelcontextprotocol.io/extensions/client-matrix" title: "Model Context Protocol, Extension Support Matrix (undated page; table read live), checked 2026-10-29" last_modified: 2026-10-29T00:00:00Z - id: ref-15 resource: "https://claude.com/resources/articles/enterprise-managed-auth" title: "Anthropic, Centrally manage authorization for MCP connectors, 2026-06-18 (updated 2026-08-24), checked 2026-10-29: \"Update: Enterprise-managed authorization is now generally available and supports Datadog, Notion, and Slack with Exa, Miro, and Zoom coming soon in addition to the existing support for Asana, Atlassian, Canva, Figma, Granola, Linear, and Supabase. (August 24, 2026)\" \"Enterprise-managed auth is the first implementation of the Enterprise-Managed Authorization extension to the Model Context Protocol.\"" last_modified: 2026-08-24T00:00:00Z - id: ref-16 resource: "https://xaa.dev/" title: "Okta, Open Sandbox to Learn and Debug Cross App Access (xaa.dev, undated page), checked 2026-10-29: \"Cross App Access (XAA) implements OAuth Identity Assertion Authorization Grant (ID-JAG).\" \"Watch a real IDP issue an ID-JAG, exchange it for an access token, and call a protected API.\"" last_modified: 2026-10-29T00:00:00Z - id: ref-17 resource: "https://developer.okta.com/blog/2025/06/23/enterprise-ai" title: "Okta Developer, Semona Igama, Integrate Your Enterprise AI Tools with Cross App Access (XAA), 2025-06-23 (last updated 2026-08-31), checked 2026-10-29: \"Semona Igama June 23, 2025 Last Updated: August 31, 2026\" \"for a more detailed step-by-step explanation of the flow, see Appendix A.3 of the Identity Assertion Authorization Grant.\"" last_modified: 2026-08-31T00:00:00Z - id: ref-18 resource: "https://www.okta.com/newsroom/press-releases/okta-announces-cross-app-access-partners/" title: "Okta, Okta advances the industry standard for secure AI agent connections with expanding Cross App Access ecosystem (press release), 2026-06-23, checked 2026-10-29: \"25+ early adopters include Anthropic, Aquera, Archestra.AI, Asana, Atlassian, Canva, Cloudflare, Cursor, Datadog, Docker, Figma, Glean, Granola, Keycard, Keycloak, Linear, MintMCP, Scalekit, Serval, Slack, Stytch by Twilio, Supabase, VS Code, WorkOS, Zoom, and Zuplo.\"" last_modified: 2026-06-23T00:00:00Z - id: ref-19 resource: "https://www.okta.com/en-gb/newsroom/press-releases/okta-brings-first-class-identity-to-ai-agents-with-agent-sso/" title: "Okta, Okta brings first-class identity to AI agents with Agent SSO (press release), 2026-08-24, checked 2026-10-29: \"SAN FRANCISCO, August 24, 2026 — Okta, Inc. (NASDAQ: OKTA), the leading independent identity partner, today announced the general availability of Agent SSO,\" \"Cross App Access is an open, vendor-neutral protocol that allows identity security to follow agents dynamically across applications.\" \"Cross App Access extends OAuth and is formally incorporated as the official Enterprise-Managed Authorization extension for the Model Context Protocol.\"" last_modified: 2026-08-24T00:00:00Z - id: ref-20 resource: "https://developer.okta.com/blog/2026/08/21/xaa-oidc-requesting" title: "Okta Developer, Sohail Pathan, Add Cross App Access to Your OIDC Requesting Application, 2026-08-21, checked 2026-10-29: \"Sohail Pathan August 21, 2026\" \"The Identity Assertion Authorization Grant specification, the basis of XAA, was designed with OIDC in mind.\"" last_modified: 2026-08-21T00:00:00Z - id: ref-21 resource: "https://auth0.com/blog/xaa-protocol-auth0-ai-agents/" title: "Auth0, Adopting the Cross App Access Protocol in Auth0 (blog), 2026-08-06, checked 2026-10-29: \"Note: If you are building a Requesting App, native support is anticipated to be available by August 31, 2026 through Token Vault.\" \"This allows you to expose your APIs and MCP servers to trusted external agents safely, seamlessly and with zero code changes to your application layer.\"" last_modified: 2026-08-06T00:00:00Z - id: ref-22 resource: "https://auth0.com/changelog" title: "Auth0, Auth0 Changelog (entry dated 2026-08-31), checked 2026-10-29: \"August 31, 2026 added Cross-App Access Requesting App now in Early Access We're excited to announce that Auth0 now supports acting as a requesting application in Cross-App Access flows in Early Access.\"" last_modified: 2026-08-31T00:00:00Z - id: ref-23 resource: "https://martechseries.com/sales-marketing/id-mgmt/descope-unveils-cross-app-access-xaa-support-letting-enterprises-manage-ai-agent-access-with-their-existing-identity-providers/" title: "MarTech Series (Globe Newswire release), Descope Unveils Cross-App Access (XAA) Support, Letting Enterprises Manage AI Agent Access With Their Existing Identity Providers, 2026-09-01, checked 2026-10-29: \"Descope is among the first identity providers to support both: ID-JAG token validation, enabling SSO-like login for any AI agent accessing Descope customers' MCP servers ID-JAG token issuance, enabling SSO-like login for Descope customers' AI agents accessing any MCP server\" \"Organizations can now use Descope to validate ID-JAG tokens from their customers' identity providers, issue ID-JAG tokens for their own internal agents, and provide self-service XAA setup to tenant admins\"" last_modified: 2026-09-01T00:00:00Z - id: ref-24 resource: "https://www.keycloak.org/securing-apps/identity-assertion-jwt-authorization-grant" title: "Keycloak, Identity Assertion JWT Authorization Grant - Keycloak (guide, undated page), checked 2026-10-29: \"Implemented (Receiver Side): Keycloak can currently act as the Receiver (Domain B), successfully accepting an ID-JAG Identity Assertion from an external Issuer and granting a local access token.\" \"Not Yet Implemented (Issuer Side): Native, out-of-the-box support for Keycloak to act as the Issuer (generating the specific ID-JAG Identity Assertion on demand) is not yet fully implemented.\"" last_modified: 2026-10-29T00:00:00Z - id: ref-25 resource: "https://docs.pingidentity.com/pingfederate/13.1/administrators_reference_guide/pf_configuring_refresh_token_to_idjag_exchange.html" title: "Ping Identity, Configuring a refresh token-to-ID-JAG token exchange (PingFederate Server documentation, undated page), checked 2026-10-29: \"Issued ID-JAG tokens use the typ header value oauth-id-jag+jwt.\" \"Version 13.1.4 (Latest)\"" last_modified: 2026-10-29T00:00:00Z - id: ref-26 resource: "https://www.atlassian.com/blog/development/enterprise-managed-authorization-rovo-mcp-xaa-id-jag" title: "Atlassian, How We Brought Enterprise-Managed Authorization to Rovo MCP with XAA and ID-JAG (Inside Atlassian), 2026-06-29, checked 2026-10-29: \"We recently added support for Enterprise-Managed Authorization in Atlassian Rovo MCP server using Cross-App Access (XAA) and the Identity Assertion JWT Authorization Grant (ID-JAG).\" \"This feature is currently in private beta.\"" last_modified: 2026-06-29T00:00:00Z - id: ref-27 resource: "https://workos.com/blog/cross-app-access-converged-in-eight-days" title: "WorkOS, Maria Paktiti, Three identity vendors shipped the same agent access pattern in eight days, 2026-09-04, checked 2026-10-29: \"Okta made Agent SSO generally available on August 24, folding Cross App Access into the identity product it says more than 20,000 customers use. Auth0 moved the requesting-app half of Cross App Access out of beta and into early access on August 31. Descope announced ID-JAG validation and issuance on September 1. Three companies that compete head to head for the same enterprise deal shipped the same handshake in eight days.\"" last_modified: 2026-09-04T00:00:00Z - id: ref-28 resource: "https://insights.bostonidentity.com/research/ietf-datatracker-2026-05-21-identity-assertion-authorization-grant" title: "Boston Identity (IAM Insights), The Cross App Access draft swaps the user's consent click for an admin's policy, and leaves agents for later, 2026-10-02, checked 2026-10-29: \"A working-group draft, not a finished standard: it expires in November 2026, names no implementations, and one of its own examples contradicts the grant it defines.\"" last_modified: 2026-10-02T00:00:00Z - id: ref-29 resource: "https://mailarchive.ietf.org/arch/msg/oauth/NoZBOm9lKASfXISp-YVlXr01xrk/" title: "IETF OAuth WG mailing list archive, message from Atul Tulshibagwale, 2026-10-27 16:49 UTC, checked 2026-10-29: \"[OAUTH-WG] Should we enable users to consent to issuing ID-JAGs?\" \"In a way, it is like indirectly issuing an access token. I can see consumer scenarios where this might require user consent. However, I don't know if the current draft allows for that.\"" last_modified: 2026-10-27T00:00:00Z - id: ref-30 resource: "https://mcp.notion.com/.well-known/oauth-authorization-server" title: "mcp.notion.com, OAuth authorization server metadata (JSON; parsed live), checked 2026-10-29: \"urn:ietf:params:oauth:grant-profile:id-jag\" \"urn:ietf:params:oauth:grant-type:jwt-bearer\"" last_modified: 2026-10-29T00:00:00Z - id: ref-31 resource: "https://mcp.linear.app/.well-known/oauth-authorization-server" title: "mcp.linear.app, OAuth authorization server metadata (JSON; parsed live), checked 2026-10-29: \"urn:ietf:params:oauth:grant-profile:id-jag\" \"urn:ietf:params:oauth:grant-type:jwt-bearer\"" last_modified: 2026-10-29T00:00:00Z - id: ref-32 resource: "https://mcp.figma.com/.well-known/oauth-authorization-server" title: "mcp.figma.com, OAuth authorization server metadata (JSON; parsed live), checked 2026-10-29: \"urn:ietf:params:oauth:grant-profile:id-jag\" \"urn:ietf:params:oauth:grant-type:jwt-bearer\"" last_modified: 2026-10-29T00:00:00Z - id: ref-33 resource: "https://zuplo.com/.well-known/oauth-authorization-server" title: "zuplo.com, OAuth authorization server metadata (JSON; issuer auth.zuplo.com; parsed live), checked 2026-10-29: \"urn:ietf:params:oauth:grant-profile:id-jag\" \"urn:ietf:params:oauth:grant-type:jwt-bearer\"" last_modified: 2026-10-29T00:00:00Z - id: ref-34 resource: "https://lovable.dev/.well-known/oauth-authorization-server" title: "lovable.dev, OAuth authorization server metadata (JSON; parsed live), checked 2026-10-29: \"urn:ietf:params:oauth:grant-profile:id-jag\" \"urn:ietf:params:oauth:grant-type:jwt-bearer\"" last_modified: 2026-10-29T00:00:00Z --- # Identity Assertion JWT Authorization Grant (ID-JAG) Identity Assertion JWT Authorization Grant (ID-JAG) is an agentic-web standard (endpoint — /.well-known/oauth-authorization-server) at step 3, Permit, governed by IETF OAuth Working Group; its status is "Active Internet-Draft. WG state WG Document". It answers: "How can an app or AI agent, already SSO-federated to a user's enterprise identity provider, obtain scoped access to a third-party API or MCP server without a fresh consent screen at that third party?" Implementation status is multi-implementation, last verified 2026-10-29. # Overview The Identity Assertion JWT Authorization Grant lets an application that a user signed in to through an enterprise identity provider get an access token for a different company's API without a new consent screen at that API [^ref-2]. The client trades its ID token, SAML assertion or refresh token at the identity provider for a short-lived signed grant using OAuth Token Exchange, then presents that grant to the API's authorization server under the JWT bearer grant, and that server still applies its own policy [^ref-2]. The work began as an individual Okta-authored draft and is now an Internet-Draft of the IETF OAuth Working Group that has not been sent to the IESG, with the -04 revision due to expire in November 2026 [^ref-1][^ref-2][^ref-5]. The Model Context Protocol has adopted it as the basis of its Enterprise-Managed Authorization extension, and Okta markets the pattern as Cross App Access [^ref-10][^ref-12][^ref-16]. # Examples ```http GET https://{resource_authorization_server}/.well-known/oauth-authorization-server # parse: RFC 8414 JSON metadata document; presence of "urn:ietf:params:oauth:grant-profile:id-jag" in authorization_grant_profiles_supported (and "urn:ietf:params:oauth:grant-type:jwt-bearer" in grant_types_supported, which this profile requires alongside it) indicates the Resource Authorization Server implements the Identity Assertion JWT Authorization Grant / Cross-App Access profile # on absent: The Resource Authorization Server does not advertise support for ID-JAG/XAA; an app cannot obtain access to this API via identity-assertion cross-app access without out-of-band, vendor-specific configuration. Absence is not conclusive proof of non-support, since the spec allows a server to omit the discovery signal and instead disclose acceptance only via a protected, per-client mechanism ``` # Knowledge Graph * **Lifecycle Step**: [3 Permit](/category/permit/index.md) * **Builds on**: [OAuth Protected Resource and Authorization Server Metadata (as used for agent authorization)](/okf/protocols/oauth-metadata-for-agents.md) * **Depended on by**: [auth.md](/okf/protocols/auth-md.md), [Identity Continuation Assertion for OAuth 2.0 Token Exchange](/okf/protocols/oauth-id-continuation.md) * **Pairs with**: [OAuth Protected Resource and Authorization Server Metadata (as used for agent authorization)](/okf/protocols/oauth-metadata-for-agents.md), [OAuth Client ID Metadata Document](/okf/protocols/oauth-cimd.md), [Model Context Protocol](/okf/protocols/mcp.md), [AAuth (Hardt)](/okf/protocols/aauth-hardt.md), [AI Identity Management System (AIMS)](/okf/protocols/wimse-aims.md), [Workload Authorization Grant (WAG)](/okf/protocols/workload-authz-grant.md) * **Compared in**: [OAuth 2.0 Consent & DCR vs CIMD & Agent OAuth Metadata (classic vs agentic)](/compare/oauth-vs-cimd/index.md), [Agent Authorization Grant vs Identity Assertion JWT Authorization Grant (ID-JAG)](/compare/aauth-vs-identity-assertion-authz-grant/index.md), [Identity Assertion JWT Authorization Grant (ID-JAG) vs OAuth Profile for Delegated AI Agent Authorization](/compare/identity-assertion-authz-grant-vs-daap/index.md) [^ref-1]: IETF Datatracker, draft-ietf-oauth-identity-assertion-authz-grant-04 - Identity Assertion JWT Authorization Grant (document page), checked 2026-10-29: "Intended RFC status (None)" "WG state WG Document" "IESG state I-D Exists" "Replaces draft-parecki-oauth-identity-assertion-authz-grant" (https://datatracker.ietf.org/doc/draft-ietf-oauth-identity-assertion-authz-grant/) [^ref-2]: A. Parecki (Okta), K. McGuinness (Independent), B. Campbell (Ping Identity), Identity Assertion JWT Authorization Grant, draft-ietf-oauth-identity-assertion-authz-grant-04 (Internet-Draft, HTML), 2026-05-21, checked 2026-10-29: "Workgroup: Web Authorization Protocol Internet-Draft: draft-ietf-oauth-identity-assertion-authz-grant-04 Published: 21 May 2026 Intended Status: Standards Track Expires: 22 November 2026 Authors: A. Parecki Okta K. McGuinness Independent B. Campbell Ping Identity" "This Internet-Draft will expire on 22 November 2026." "This specification provides a mechanism for an application to use an identity assertion to obtain an access token for a third-party API by coordinating through an identity provider that the downstream Resource Authorization Server already trusts for single sign-on (SSO), using Token Exchange [RFC8693] and JWT Profile for OAuth 2.0 Authorization Grants [RFC7523]." "This pattern is informally referred to as Cross-App Access (XAA)." "The Resource Authorization Server still applies local policy to decide whether to honor the grant, whether to narrow or reject the requested access, and what access token to issue." "The typ of the JWT indicated in the JWT header MUST be oauth-id-jag+jwt." "identity_chaining_requested_token_types_supported indicates which token types an IdP Authorization Server can issue for identity chaining, while authorization_grant_profiles_supported indicates which authorization grant profiles a Resource Authorization Server can process." "To advertise support for issuing an Identity Assertion JWT Authorization Grant via Token Exchange, the IdP Authorization Server SHOULD include the following value in identity_chaining_requested_token_types_supported:" "To advertise support for the Identity Assertion JWT Authorization Grant profile, the Resource Authorization Server SHOULD include the following value in the authorization_grant_profiles_supported property:" "A Resource Authorization Server that includes urn:ietf:params:oauth:grant-profile:id-jag in authorization_grant_profiles_supported for this specification MUST also include urn:ietf:params:oauth:grant-type:jwt-bearer in grant_types_supported." "Inclusion of a profile identifier in authorization_grant_profiles_supported indicates only that the Resource Authorization Server implements the processing rules for that profile. It does not indicate that any particular issuer, tenant, client, subject, audience, or authorization request will be accepted." "Resource Authorization Servers MUST NOT use authorization_grant_profiles_supported to disclose issuer allow lists or other profile-specific trust relationships." "Resource Authorization Servers MAY provide a protected discovery mechanism by which an authenticated client can determine whether an Identity Assertion JWT Authorization Grant from a particular issuer would be accepted for that client." "If the urn:ietf:params:oauth:grant-profile:id-jag authorization grant profile is supported, the AI Agent can first attempt to silently obtain an access token using an Identity Assertion JWT Authorization Grant from the IdP Authorization Server trusted by the External Tool Resource Authorization Server for SSO" "This section registers oauth-id-jag+jwt, a new media type [RFC2046] in the "Media Types" registry" "This section registers urn:ietf:params:oauth:token-type:id-jag in the "OAuth URI" subregistry" "A.3. Email and Calendaring Applications A.3.1. Preconditions A.4. AI Agent using External Tools" (https://www.ietf.org/archive/id/draft-ietf-oauth-identity-assertion-authz-grant-04.html) [^ref-3]: IETF Datatracker, API, document record for draft-ietf-oauth-identity-assertion-authz-grant (JSON; times UTC), checked 2026-10-29: "expires": "2026-11-22T22:18:28Z" (https://datatracker.ietf.org/api/v1/doc/document/draft-ietf-oauth-identity-assertion-authz-grant/) [^ref-4]: IETF Datatracker, API, new-revision events for draft-ietf-oauth-identity-assertion-authz-grant (JSON; times UTC), checked 2026-10-29: "rev": "00", "time": "2025-09-08T21:11:46Z" "rev": "01", "time": "2025-10-19T19:41:50Z" "rev": "02", "time": "2026-03-02T20:10:50Z" "rev": "03", "time": "2026-04-22T22:16:37Z" "rev": "04", "time": "2026-05-21T22:18:28Z" (https://datatracker.ietf.org/api/v1/doc/newrevisiondocevent/?doc__name=draft-ietf-oauth-identity-assertion-authz-grant&limit=20) [^ref-5]: IETF Datatracker, API, new-revision events for the individual draft-parecki-oauth-identity-assertion-authz-grant (JSON; times UTC), checked 2026-10-29: "rev": "00", "time": "2024-03-02T01:23:02Z" "rev": "05", "time": "2025-07-02T23:20:43Z" (https://datatracker.ietf.org/api/v1/doc/newrevisiondocevent/?doc__name=draft-parecki-oauth-identity-assertion-authz-grant&limit=20) [^ref-6]: IANA, OAuth Parameters (registry page; scanned for the draft's requested entries, none present), checked 2026-10-29 (https://www.iana.org/assignments/oauth-parameters) [^ref-7]: GitHub REST API, oauth-wg/oauth-identity-assertion-authz-grant open pull requests (JSON; times UTC), checked 2026-10-29: "title": "Specify how the Resource Authorization Server finds ID-JAG signing keys" "title": "Allow IdP to accept its own ID-JAGs when explicitly configured" (https://api.github.com/repos/oauth-wg/oauth-identity-assertion-authz-grant/pulls?state=open&per_page=50) [^ref-8]: GitHub REST API, oauth-wg/oauth-identity-assertion-authz-grant recent commits on the default branch (JSON; times UTC), checked 2026-10-29: "message": "update changelog" (https://api.github.com/repos/oauth-wg/oauth-identity-assertion-authz-grant/commits?per_page=10) [^ref-9]: IETF Datatracker, draft-ietf-oauth-identity-chaining-17 - OAuth Identity and Authorization Chaining Across Domains (document page), checked 2026-10-29: "Intended RFC status Proposed Standard" "IESG state RFC Ed Queue" (https://datatracker.ietf.org/doc/draft-ietf-oauth-identity-chaining/) [^ref-10]: Model Context Protocol, Enterprise-Managed Authorization - Model Context Protocol (extension overview, undated page), checked 2026-10-29: "The Enterprise-Managed Authorization extension (io.modelcontextprotocol/enterprise-managed-authorization) enables organizations to control MCP server access centrally through their existing identity provider (IdP)." "The MCP Client requests a special type of token from the enterprise IdP called an Identity Assertion JWT Authorization Grant, or ID-JAG." "Extensions are opt-in and never active by default." (https://modelcontextprotocol.io/extensions/auth/enterprise-managed-authorization) [^ref-11]: Model Context Protocol, ext-auth repository, Enterprise-Managed Authorization specification, protocol revision 2026-07-28 (raw Markdown), checked 2026-10-29: "This document specifies how an MCP Client can obtain an access token from an MCP Server's authorization server by presenting an identity assertion it previously obtained from an enterprise Identity Provider during single sign-on" "Protocol Revision: 2026-07-28" (https://raw.githubusercontent.com/modelcontextprotocol/ext-auth/main/specification/stable/enterprise-managed-authorization/2026-07-28/enterprise-managed-authorization.mdx) [^ref-12]: Model Context Protocol Blog, Enterprise-Managed Authorization: Zero-touch OAuth for MCP, 2026-06-18, checked 2026-10-29: "The Enterprise-Managed Authorization extension is now stable." "Okta is the first supported identity provider." "Anthropic has implemented the extension in its shared MCP layer for Claude. Admins can authorize MCP servers for users across Claude, Claude Code, and Cowork." "Servers: Asana, Atlassian, Canva, Figma, Granola, Linear and Supabase now support EMA, with Slack and more actively adding support." (https://blog.modelcontextprotocol.io/posts/enterprise-managed-auth/) [^ref-13]: Model Context Protocol, SEP-990: Enable enterprise IdP policy controls during MCP OAuth flows (SEP page), checked 2026-10-29: "Status Final Type Standards Track Created 2025-06-04" (https://modelcontextprotocol.io/seps/990-enable-enterprise-idp-policy-controls-during-mcp-o) [^ref-14]: Model Context Protocol, Extension Support Matrix (undated page; table read live), checked 2026-10-29 (https://modelcontextprotocol.io/extensions/client-matrix) [^ref-15]: Anthropic, Centrally manage authorization for MCP connectors, 2026-06-18 (updated 2026-08-24), checked 2026-10-29: "Update: Enterprise-managed authorization is now generally available and supports Datadog, Notion, and Slack with Exa, Miro, and Zoom coming soon in addition to the existing support for Asana, Atlassian, Canva, Figma, Granola, Linear, and Supabase. (August 24, 2026)" "Enterprise-managed auth is the first implementation of the Enterprise-Managed Authorization extension to the Model Context Protocol." (https://claude.com/resources/articles/enterprise-managed-auth) [^ref-16]: Okta, Open Sandbox to Learn and Debug Cross App Access (xaa.dev, undated page), checked 2026-10-29: "Cross App Access (XAA) implements OAuth Identity Assertion Authorization Grant (ID-JAG)." "Watch a real IDP issue an ID-JAG, exchange it for an access token, and call a protected API." (https://xaa.dev/) [^ref-17]: Okta Developer, Semona Igama, Integrate Your Enterprise AI Tools with Cross App Access (XAA), 2025-06-23 (last updated 2026-08-31), checked 2026-10-29: "Semona Igama June 23, 2025 Last Updated: August 31, 2026" "for a more detailed step-by-step explanation of the flow, see Appendix A.3 of the Identity Assertion Authorization Grant." (https://developer.okta.com/blog/2025/06/23/enterprise-ai) [^ref-18]: Okta, Okta advances the industry standard for secure AI agent connections with expanding Cross App Access ecosystem (press release), 2026-06-23, checked 2026-10-29: "25+ early adopters include Anthropic, Aquera, Archestra.AI, Asana, Atlassian, Canva, Cloudflare, Cursor, Datadog, Docker, Figma, Glean, Granola, Keycard, Keycloak, Linear, MintMCP, Scalekit, Serval, Slack, Stytch by Twilio, Supabase, VS Code, WorkOS, Zoom, and Zuplo." (https://www.okta.com/newsroom/press-releases/okta-announces-cross-app-access-partners/) [^ref-19]: Okta, Okta brings first-class identity to AI agents with Agent SSO (press release), 2026-08-24, checked 2026-10-29: "SAN FRANCISCO, August 24, 2026 — Okta, Inc. (NASDAQ: OKTA), the leading independent identity partner, today announced the general availability of Agent SSO," "Cross App Access is an open, vendor-neutral protocol that allows identity security to follow agents dynamically across applications." "Cross App Access extends OAuth and is formally incorporated as the official Enterprise-Managed Authorization extension for the Model Context Protocol." (https://www.okta.com/en-gb/newsroom/press-releases/okta-brings-first-class-identity-to-ai-agents-with-agent-sso/) [^ref-20]: Okta Developer, Sohail Pathan, Add Cross App Access to Your OIDC Requesting Application, 2026-08-21, checked 2026-10-29: "Sohail Pathan August 21, 2026" "The Identity Assertion Authorization Grant specification, the basis of XAA, was designed with OIDC in mind." (https://developer.okta.com/blog/2026/08/21/xaa-oidc-requesting) [^ref-21]: Auth0, Adopting the Cross App Access Protocol in Auth0 (blog), 2026-08-06, checked 2026-10-29: "Note: If you are building a Requesting App, native support is anticipated to be available by August 31, 2026 through Token Vault." "This allows you to expose your APIs and MCP servers to trusted external agents safely, seamlessly and with zero code changes to your application layer." (https://auth0.com/blog/xaa-protocol-auth0-ai-agents/) [^ref-22]: Auth0, Auth0 Changelog (entry dated 2026-08-31), checked 2026-10-29: "August 31, 2026 added Cross-App Access Requesting App now in Early Access We're excited to announce that Auth0 now supports acting as a requesting application in Cross-App Access flows in Early Access." (https://auth0.com/changelog) [^ref-23]: MarTech Series (Globe Newswire release), Descope Unveils Cross-App Access (XAA) Support, Letting Enterprises Manage AI Agent Access With Their Existing Identity Providers, 2026-09-01, checked 2026-10-29: "Descope is among the first identity providers to support both: ID-JAG token validation, enabling SSO-like login for any AI agent accessing Descope customers' MCP servers ID-JAG token issuance, enabling SSO-like login for Descope customers' AI agents accessing any MCP server" "Organizations can now use Descope to validate ID-JAG tokens from their customers' identity providers, issue ID-JAG tokens for their own internal agents, and provide self-service XAA setup to tenant admins" (https://martechseries.com/sales-marketing/id-mgmt/descope-unveils-cross-app-access-xaa-support-letting-enterprises-manage-ai-agent-access-with-their-existing-identity-providers/) [^ref-24]: Keycloak, Identity Assertion JWT Authorization Grant - Keycloak (guide, undated page), checked 2026-10-29: "Implemented (Receiver Side): Keycloak can currently act as the Receiver (Domain B), successfully accepting an ID-JAG Identity Assertion from an external Issuer and granting a local access token." "Not Yet Implemented (Issuer Side): Native, out-of-the-box support for Keycloak to act as the Issuer (generating the specific ID-JAG Identity Assertion on demand) is not yet fully implemented." (https://www.keycloak.org/securing-apps/identity-assertion-jwt-authorization-grant) [^ref-25]: Ping Identity, Configuring a refresh token-to-ID-JAG token exchange (PingFederate Server documentation, undated page), checked 2026-10-29: "Issued ID-JAG tokens use the typ header value oauth-id-jag+jwt." "Version 13.1.4 (Latest)" (https://docs.pingidentity.com/pingfederate/13.1/administrators_reference_guide/pf_configuring_refresh_token_to_idjag_exchange.html) [^ref-26]: Atlassian, How We Brought Enterprise-Managed Authorization to Rovo MCP with XAA and ID-JAG (Inside Atlassian), 2026-06-29, checked 2026-10-29: "We recently added support for Enterprise-Managed Authorization in Atlassian Rovo MCP server using Cross-App Access (XAA) and the Identity Assertion JWT Authorization Grant (ID-JAG)." "This feature is currently in private beta." (https://www.atlassian.com/blog/development/enterprise-managed-authorization-rovo-mcp-xaa-id-jag) [^ref-27]: WorkOS, Maria Paktiti, Three identity vendors shipped the same agent access pattern in eight days, 2026-09-04, checked 2026-10-29: "Okta made Agent SSO generally available on August 24, folding Cross App Access into the identity product it says more than 20,000 customers use. Auth0 moved the requesting-app half of Cross App Access out of beta and into early access on August 31. Descope announced ID-JAG validation and issuance on September 1. Three companies that compete head to head for the same enterprise deal shipped the same handshake in eight days." (https://workos.com/blog/cross-app-access-converged-in-eight-days) [^ref-28]: Boston Identity (IAM Insights), The Cross App Access draft swaps the user's consent click for an admin's policy, and leaves agents for later, 2026-10-02, checked 2026-10-29: "A working-group draft, not a finished standard: it expires in November 2026, names no implementations, and one of its own examples contradicts the grant it defines." (https://insights.bostonidentity.com/research/ietf-datatracker-2026-05-21-identity-assertion-authorization-grant) [^ref-29]: IETF OAuth WG mailing list archive, message from Atul Tulshibagwale, 2026-10-27 16:49 UTC, checked 2026-10-29: "[OAUTH-WG] Should we enable users to consent to issuing ID-JAGs?" "In a way, it is like indirectly issuing an access token. I can see consumer scenarios where this might require user consent. However, I don't know if the current draft allows for that." (https://mailarchive.ietf.org/arch/msg/oauth/NoZBOm9lKASfXISp-YVlXr01xrk/) [^ref-30]: mcp.notion.com, OAuth authorization server metadata (JSON; parsed live), checked 2026-10-29: "urn:ietf:params:oauth:grant-profile:id-jag" "urn:ietf:params:oauth:grant-type:jwt-bearer" (https://mcp.notion.com/.well-known/oauth-authorization-server) [^ref-31]: mcp.linear.app, OAuth authorization server metadata (JSON; parsed live), checked 2026-10-29: "urn:ietf:params:oauth:grant-profile:id-jag" "urn:ietf:params:oauth:grant-type:jwt-bearer" (https://mcp.linear.app/.well-known/oauth-authorization-server) [^ref-32]: mcp.figma.com, OAuth authorization server metadata (JSON; parsed live), checked 2026-10-29: "urn:ietf:params:oauth:grant-profile:id-jag" "urn:ietf:params:oauth:grant-type:jwt-bearer" (https://mcp.figma.com/.well-known/oauth-authorization-server) [^ref-33]: zuplo.com, OAuth authorization server metadata (JSON; issuer auth.zuplo.com; parsed live), checked 2026-10-29: "urn:ietf:params:oauth:grant-profile:id-jag" "urn:ietf:params:oauth:grant-type:jwt-bearer" (https://zuplo.com/.well-known/oauth-authorization-server) [^ref-34]: lovable.dev, OAuth authorization server metadata (JSON; parsed live), checked 2026-10-29: "urn:ietf:params:oauth:grant-profile:id-jag" "urn:ietf:params:oauth:grant-type:jwt-bearer" (https://lovable.dev/.well-known/oauth-authorization-server)