agenticweb.wiki

Identity Continuation Assertion for OAuth 2.0 Token Exchange

Identity Continuation Assertion for OAuth 2.0 Token Exchange is an agentic-web standard (document format) at step 3, Permit, governed by IETF OAuth Working Group (Web Authorization Protocol). Standards Track working-group draft; its own status is "Active Internet-Draft, OAuth WG document, Intended status: Standards Track; draft-mcguinness-oauth-id-continuation-assertion-02 dated 2026-09-09, expires 2027-03-13" (working group). It answers: How can a workload obtain an ID-JAG for another service after the user who started the session is no longer present? Adoption is unmeasured, last verified 2026-10-20.

Permit draft-mcguinness-oauth-id-continuation-assertion-02 is a Standards Track Internet-Draft of the IETF Web Authorization Protocol (OAuth) working group, dated 9 September 2026 and expiring 13 March 2027 [1]. It defines a short-lived, sender-constrained JWT used as a token-exchange subject token, so a workload can obtain an Identity Assertion JWT Authorization Grant (ID-JAG) for another service after the user has left [1].

Overview

It extends the ID-JAG profile already tracked as identity-assertion-authz-grant. It is a separate record from the Workload Authorization Grant, the Agent-Delegation header, and both AAP documents. The datatracker entry for the draft is [2].

Discovery and probe

OAuth 2.0 token exchange (RFC 8693). The assertion is a subject token, not a file on the origin.

n/a n/a (token-exchange subject token; no fixed origin artifact)
parse:     n/a. The assertion is presented as a subject token in a token-exchange request.
on absent: No public artifact is defined, so absence at an origin is expected.

Not probed live: needs-credentials. The identity-continuation assertion is a token-exchange subject token; it is not published at a fixed path.

History

Instances

No instances recorded yet.

See also

References

  1. draft-mcguinness-oauth-id-continuation-assertion-02 is a Standards Track Internet-Draft of the Web Authorization Protocol (OAuth) working group, dated 9 September 2026 and expiring 13 March 2027. It defines a short-lived sender-constrained JWT used as a token-exchange subject token so a workload can obtain an ID-JAG after the user has left. — https://www.ietf.org/archive/id/draft-mcguinness-oauth-id-continuation-assertion-02.txt (2026-09-09) VERIFIED
  2. Datatracker document page for draft-mcguinness-oauth-id-continuation-assertion. — https://datatracker.ietf.org/doc/draft-mcguinness-oauth-id-continuation-assertion/ (2026-09-09) VERIFIED

JSON · Markdown