SCIM Profile for Agent Principal Management

1.1. Scope

This profile defines explicit bindings and associations for delegated ID-JAG issuance, and registration of platform-hosted agents for governance without issuance (Section 7). It supports the federation draft's dedicated-client, SPIFFE, Client Attestation, and existing platform JWT resolution inputs of [FEDERATION] and [INPUTS]. Implementations need only support the credential classes they accept under [FEDERATION].¶

The following remain outside this profile:¶

• Establishing trust in a new credential authority. Trust remains a prerequisite, not an effect of a binding write. OAuth client registration is defined separately by [OAUTH-CLIENT].¶

• User delegation, resource permissions, and cross-domain user linking.¶

• Runtime enrollment, credential issuance, key custody, and instance continuity.¶

• Relationship-change events and revocation of outstanding authorization.¶

• A portable policy language, automatic principal merging, and a WAG wire composition.¶

4.1. Common Attributes and References

Agent, AgentIdentityBinding, and AgentClientAssociation use SCIM schemas, id, externalId, and meta. The rules below apply to those three types; OAuthClient attribute and operation rules remain those of [OAUTH-CLIENT].¶

• Common conventions: externalId correlation, identifiers, versions, conditional writes, explicit active state, incremental reads, and durable restriction follow the common provisioning conventions of [OAUTH-CLIENT]. Here externalId identifies the connector's record, not a principal, and remains readWrite.¶

• Stable identity: SCIM id and the federation subject remain server-assigned and non-reassignable. Changing externalId cannot redirect a reference or change the Agent Principal. Version changes cover all modifications visible through this interface.¶

• References: A relationship reference is a single-valued complex attribute. Its REQUIRED string value is the target resource's SCIM id; its OPTIONAL read-only $ref is a reference to that resource, with referenceTypes set to the named target type. The Service Provider resolves value locally and MUST NOT fetch a caller-supplied $ref to establish the relationship. An OPTIONAL read-only string display can supply a human-readable label; it is never a lookup key.¶

The schema tables below and JSON definitions in Appendix C are normative. Unless specified otherwise, attributes are required, immutable, single-valued, returned by default, and have uniqueness none. String values are case-exact. Exceptions appear with each table. credentialClass is a case-exact enumeration: /Schemas MUST publish accepted values from Section 4.3.1 as canonicalValues. Values outside the advertised set are rejected with invalidValue. The common attributes retain SCIM's characteristics except for the externalId uniqueness rule in those conventions. Attribute-name processing remains that of SCIM, independently of case-exact identity values.¶

Reference sub-attributes have value mutability immutable; $ref and display have mutability readOnly. They use uniqueness none and returned default. display has caseExact: false. A reference's requiredness is given in its resource table. Identity values MUST NOT be normalized, case-folded, or matched by prefix.¶

4.2. Agent Federation Extension

The Agent resource uses [SCIM-AGENT], including its agentUserName, displayName, and active attributes. It adds the required extension:¶

urn:ietf:params:scim:schemas:extension:agent-federation:2.0:Agent¶

The extension name is AgentFederation. Both attributes are read-only strings. subject is required; issuer is optional.¶

The Service Provider assigns subject when creating the Agent. Its issuer is fixed by the SCIM service's authenticated Provisioning Domain; if returned explicitly, issuer MUST equal that configured value. The pair remains the federation identity even when issuer is omitted. The ResourceType declares this extension required: true. Creation requests MUST include its URI in schemas and an extension object; that object MAY be empty because its values are server-assigned. The server populates subject in the response. Supplied read-only values follow SCIM processing and MUST NOT select an existing principal. The subject MUST be unique and non-reassignable across all Governance Tenants sharing that issuer, as required by [FEDERATION]. Changing the administrative authority represented by the principal is not an update of these attributes.¶

For this profile, active: false prevents new grants involving the principal. active: true permits evaluation of the other required relationships; it does not bypass IdP policy, suspension, or delegation checks. The Service Provider MUST authorize changes to active separately from descriptive edits. Renaming the Agent, changing its owners, or changing its externalId in an upstream platform does not change the federation identity or grant permissions.¶

4.3. Identity Binding

An AgentIdentityBinding links one resolution identity to one Agent. For dedicated-client resolution it references an OAuthClient. For workload resolution it names an external identity under an approved credential authority. The credential class determines which representation applies. Its schema URI is:¶

urn:ietf:params:scim:schemas:core:2.0:AgentIdentityBinding¶

selectors is optional and multi-valued. active is required and readWrite. Creation and PUT MUST supply an explicit boolean; removal is invalid. Only true permits use, subject to the remaining checks. The reference target type of agent is Agent; that of client is OAuthClient. client, sourceAuthority, and sourceSubject have schema characteristic required: false with these conditional requirements:¶

• For dedicated-client, client MUST be present and sourceAuthority, sourceSubject, and selectors MUST be absent. The IdP resolves the authenticated client to the referenced OAuthClient using its configured authorization-server issuer and exact client_id.¶

• For all other classes, sourceAuthority and sourceSubject MUST be present and client MUST be absent. The external identity is validated and matched under Section 4.3.1; an OAuthClient reference cannot substitute for that evidence.¶

Every referenced OAuthClient's authorizationServer MUST equal the governing IdP issuer from the Provisioning Domain, and be authorized in the same Governance Tenant. A CIMD URL is taken from the referenced client's clientId; its document origin is not the IdP issuer. Client metadata and key changes follow [OAUTH-CLIENT] and do not change this binding.¶

A dedicated-client binding explicitly administers identity resolution and Client Association together: client identifies the resolution source; the active binding permits that client to use it for delegated ID-JAG issuance. Creation and activation MUST be authorized for both decisions. active controls both. This is the combined administration permitted by [FEDERATION], not permission inferred from client authentication. No separate AgentClientAssociation is used for this class. Withdrawing client use deactivates the binding without changing the Agent Principal. Other input classes keep identity resolution and client-use permission in separate resources.¶

Each selectors element has REQUIRED single-valued string attributes path and value, both immutable, case-exact, returned by default, and with uniqueness none. path is a JSON Pointer string under Section 5 of [RFC6901]. value is the expected claim value. Duplicate paths MUST be rejected. Selector order has no significance; all selectors participate in the match defined by [FEDERATION]. Selectors are permitted only for platform-jwt; they cannot replace sourceAuthority or sourceSubject. Adding, removing, or changing selectors after creation requires a new binding, including when the original binding had no selectors. This narrows SCIM's permission to initially populate an unassigned immutable attribute.¶

clientInstanceId and receiverScope are optional, single-valued, immutable, case-exact strings, returned by default, with uniqueness none. They are permitted only for client-attestation, where they make a managed-installation binding ([INPUTS]), and MUST be both present or both absent. clientInstanceId is the exact client_instance_id ([INSTANCE]); receiverScope identifies the IdP Receiver Scope configured for that attester and client. The Service Provider MUST reject a binding whose level, client-level or installation-level, differs from the resolution level configured for that attester and client. Adding or removing them requires a new binding.¶

4.4. Client Association

An AgentClientAssociation permits one authenticated IdP OAuth client to use one external-identity binding for delegated ID-JAG issuance. A dedicated-client binding carries its own permission and MUST NOT be referenced here. Multiple resources can express an explicitly enumerated binding set. This is an explicit narrowing of Federation's policy-defined binding sets to one binding per resource. This profile defines no predicates that automatically cover future bindings. Its schema URI is:¶

urn:ietf:params:scim:schemas:core:2.0:AgentClientAssociation¶

active has the same characteristics as in Section 4.3. The reference target type of binding is AgentIdentityBinding; that of client is OAuthClient. Each uses the value and $ref characteristics in Section 4.1. The client reference carries a SCIM id, not client_id.¶

The binding determines the Agent and permitted credential class. An association MUST NOT be interpreted as permission to use another binding to the same Agent, even with the same credential class. For external-identity resolution, the reference independently selects the client permitted to present that identity; it need not identify the workload credential's subject. The client's authorizationServer MUST equal the governing IdP issuer. A matching client_id at another authorization server does not qualify.¶

For a CIMD client managed under [OAUTH-CLIENT], client.value still references its SCIM id; its OAuth client_id remains the Client Identifier URL. Document discovery and local admission establish neither an Identity Binding nor a Client Association. Document metadata changes MUST NOT create or expand those relationships.¶

The Service Provider MUST validate the referenced binding and client registration and authorize their use together. It MUST reject duplicate associations for the same binding and client in the Governance Tenant, regardless of active state. All client-use permissions in this profile apply only to delegated ID-JAG issuance. No per-resource flow attribute is needed; these permissions MUST NOT authorize WAG or another grant path.¶

The association is necessary permission to use this binding. Target, scope, user delegation, and other policy constraints remain independently configured and evaluated by the IdP. This resource does not express or override them.¶

5.1. Creation and Retry Recovery

An Agent creation allocates a new principal unless an administrator has already established its representation outside this creation operation. POST MUST NOT attach to an existing principal by matching agentUserName, displayName, externalId, or source credentials. To manage an existing Agent, the connector needs explicit access to that existing resource.¶

For relationships, the referenced resource MUST exist in the authorized Governance Tenant. It need not yet be active: the connector can stage an inactive Agent, its bindings, and its associations before enabling issuance. Each write is independently authorized; creation with active: true additionally requires enabling permission.¶

If a creation response is lost and externalId was supplied, the connector queries the same resource type by that value before retrying. Without it, the connector reconciles through authorized resource discovery before retrying; a repeat POST is not an idempotent operation. A duplicate POST uses 409 with scimType uniqueness; it is not an upsert. The Service Provider MUST serialize the uniqueness check with creation. The client MUST retrieve and compare the existing resource before treating a conflict as success. It MUST NOT silently overwrite a different existing relationship.¶

This profile's externalId uniqueness narrows generic SCIM behavior. It applies to live resources. Deletion and stale-writer handling follow Section 5.3; no exactly-once delivery guarantee is implied.¶

5.2. Updates and Concurrency

ETags, If-Match, the conditional requirement for activating an inactive resource, and PUT handling of immutable values follow the common provisioning conventions of [OAUTH-CLIENT]. They apply to Agent, AgentIdentityBinding, and AgentClientAssociation alike.¶

SCIM PATCH is atomic for one resource. An authorization or validation failure MUST leave that resource unchanged. Clients MUST NOT retry a stale update by fetching the new ETag and blindly overwriting the resource; they first reconcile the current state with the intended change. This prevents an old enablement from undoing a newer disablement.¶

Removing an optional value does not make an existing immutable identity replaceable. Changing a relationship's identity requires a new resource. Ordinary descriptive Agent edits do not change bindings, associations, or delegation.¶

5.3. Deletion

DELETE of an agent-management resource prevents its use for new grant issuance under Section 6. It does not revoke already-issued tokens. The Service Provider MUST NOT reuse a deleted SCIM id or an Agent Principal's qualified identity.¶

Deletion has the following dependency effects:¶

OAuthClient deletion follows [OAUTH-CLIENT], including CIMD readmission controls and the treatment of outstanding authorization. The rules here do not weaken that behavior. The Service Provider MAY retain dependent resources as non-effective references or cascade their deletion under documented administrative policy. Cascading deletion MUST be authorized for the affected dependents; otherwise they remain unusable. A new target receives a new SCIM id and MUST NOT inherit or repair the deleted resource's bindings or associations.¶

GET of a retained dependent returns its original immutable value, omits $ref and display for a missing target, and retains its administrative active value. That value does not assert effective eligibility. GET of a deleted target or cascaded dependent returns 404. Direct and filtered reads allow authorized connectors to find and remove retained references. A missing target MUST NOT prevent an authorized disablement or deletion of a dependent resource. Creation or activation with a missing target MUST be rejected.¶

A later POST with a previously used externalId is a new creation, requiring current authorization and receiving a new id (Section 8.1).¶

5.4. Query and Reconciliation

The Service Provider MUST support paginated collection reads and the following eq filters, together with and combinations:¶

OAuthClient queries follow [OAUTH-CLIENT]. Collection reads MUST return only resources within the caller's read permission. For a platform connector, an externalId lookup is scoped to its Provisioning Domain and resource type; another connector's correlation value cannot select its resource. An administrative reader spanning several domains cannot assume that externalId alone is unique.¶

Appendix A.7 shows these filters in use.¶

Incremental reads on meta.lastModified follow the common provisioning conventions of [OAUTH-CLIENT]. A connector MUST NOT delete records solely because they were absent from an incomplete or failed listing. This profile defines no change feed or event type.¶

5.5. Discovery

The Service Provider MUST expose /ServiceProviderConfig, /ResourceTypes, and /Schemas under Section 4 of [RFC7644]. It advertises PATCH, filtering, and ETag support. Each ResourceType gives the endpoint in Section 4 and the schema defined for that resource; Agent includes the federation extension in schemaExtensions with required: true.¶

The /Schemas representations MUST describe the characteristics in Section 4.1, Section 4.2, Section 4.3, and Section 4.4. Discovery advertises syntax and capabilities; it does not approve a connector, credential authority, or relationship. Unsupported credential classes remain subject to Section 4.3.1 (Section 8.1).¶

5.6. Errors

Errors follow Section 3.12 of [RFC7644]. The following mappings make the profile's failures predictable:¶

Standard SCIM request syntax, filter, authentication, and not-found errors retain their meanings. Responses MUST NOT reveal cross-tenant resource existence. Section 8.2 covers diagnostics for authorized administrators.¶

8.1. Provisioning Client

• Reversible disablement: Clients that need reversible disablement use active: false, not DELETE; a later POST receives a new id (Section 5.3). To prevent an old connector from recreating deleted records, administrators withdraw that connector's create authority; DELETE alone does not revoke its management credentials.¶

• Credential classes: The connector and the IdP agree on usable input classes during trust setup. Schema discovery advertises supported classes; it does not authorize their use (Section 5.5).¶

8.2. Service Provider

• Diagnostics: Authorized administrators need sufficient diagnostics to distinguish configuration and permission failures without exposing credentials or key material.¶

9.1. Administrative Privilege and Confused Deputies

Binding and association writes can enable impersonation of an Agent Principal. The Service Provider MUST check the connector's authority over both ends of each relationship, including on creation with disabled state and on later enablement. Permission to manage a platform catalog is not permission to bind its records to arbitrary enterprise principals.¶

Credential-authority trust remains preconfigured. sourceAuthority is an identifier to match, not a URL to fetch or an instruction to trust a new issuer. A valid workload credential or control of an OAuth client key cannot authorize an administrative write by itself. References do not permit cross-tenant attachment or SSRF.¶

9.2. Independent Controls and Stale State

OAuthClient, Agent, binding, and association enablement have distinct effects. An owner, group, or display-name update MUST NOT implicitly enable any of them. All writers to the underlying relationships, including local administrative interfaces, need to preserve the same semantics and invalidate the SCIM resource version when visible state changes.¶

A client key rotation or CIMD metadata update does not create a new Agent Principal or expand its bindings and associations. A shared client's authentication credential cannot select among agents without the resolution input required by [FEDERATION]. Dedicated-client resolution proves the authenticated client identity, not an independent runtime.¶

ETags prevent stale conditional writes; they are not lifecycle versions and do not revoke previously issued tokens. A connector that retains create or enable permission can request new access after earlier disablement, subject to current policy. Administrators SHOULD withdraw that authority when the connector itself is compromised.¶

Management changes SHOULD be audited with the administrative actor, Provisioning Domain, affected resource, and changed relationships. Audit records SHOULD identify principals and configuration changes without retaining reusable workload credentials.¶

11.1. Agent Federation Extension

• Schema URI: urn:ietf:params:scim:schemas:extension:agent-federation:2.0:Agent¶

• Schema Name: Agent Federation¶

• Intended or Associated Resource Type: Agent¶

• Purpose: Expose the IdP-qualified Agent Principal represented by a SCIM Agent resource.¶

• Single-value Attributes: issuer, subject, defined in Section 4.2.¶

• Multi-valued Attributes: None.¶

11.2. Agent Identity Binding

• Schema URI: urn:ietf:params:scim:schemas:core:2.0:AgentIdentityBinding¶

• Schema Name: Agent Identity Binding¶

• Intended or Associated Resource Type: AgentIdentityBinding¶

• Purpose: Manage an approved resolution identity's binding to an Agent Principal.¶

• Single-value Attributes: agent, credentialClass, client, sourceAuthority, sourceSubject, clientInstanceId, receiverScope, and active, defined in Section 4.3.¶

• Multi-valued Attributes: selectors, defined in Section 4.3.¶

11.3. Agent Client Association

• Schema URI: urn:ietf:params:scim:schemas:core:2.0:AgentClientAssociation¶

• Schema Name: Agent Client Association¶

• Intended or Associated Resource Type: AgentClientAssociation¶

• Purpose: Manage an OAuth client's permission to use an Identity Binding for delegated ID-JAG issuance.¶

• Single-value Attributes: binding, client, active, defined in Section 4.4.¶

• Multi-valued Attributes: None.¶

No new OAuth token type, event type, HTTP method, or SCIM error type is registered. Credential-class names are local to this profile's schema.¶

12.1. Normative References

[OAUTH-CLIENT]

McGuinness, K., "SCIM Profile for OAuth 2.0 Client Management", Work in Progress, Internet-Draft, draft-mcguinness-scim-oauth-client-management, 18 September 2026, <https://mcguinness.github.io/agent-principal-profiles/draft-mcguinness-scim-oauth-client-management.html>.

[FEDERATION]

McGuinness, K., "OAuth 2.0 Profile for Agent Principal Federation", Work in Progress, Internet-Draft, draft-mcguinness-oauth-governed-agent-federation, 18 September 2026, <https://mcguinness.github.io/agent-principal-profiles/draft-mcguinness-oauth-governed-agent-federation.html>.

[INSTANCE]

McGuinness, K., "OAuth 2.0 Client Instance Identifiers", Work in Progress, Internet-Draft, draft-mcguinness-oauth-client-instance-id-01, 2 November 2026, <https://datatracker.ietf.org/doc/html/draft-mcguinness-oauth-client-instance-id-01>.

[SCIM-AGENT]

Wahl, M., Zollner, D., Dingle, P., and I. Kazzouzi, "AI Agent Resource Extension for the System for Cross-domain Identity Management (SCIM)", Work in Progress, Internet-Draft, draft-wzdk-scim-agent-resource-00, 5 June 2026, <https://datatracker.ietf.org/doc/html/draft-wzdk-scim-agent-resource-00>.

[RFC7643]

Hunt, P., Ed., Grizzle, K., Wahlstroem, E., and C. Mortimore, "System for Cross-domain Identity Management: Core Schema", RFC 7643, DOI 10.17487/RFC7643, September 2015, <https://www.rfc-editor.org/rfc/rfc7643>.

[RFC7644]

Hunt, P., Ed., Grizzle, K., Ansari, M., Wahlstroem, E., and C. Mortimore, "System for Cross-domain Identity Management: Protocol", RFC 7644, DOI 10.17487/RFC7644, September 2015, <https://www.rfc-editor.org/rfc/rfc7644>.

[RFC6901]

Bryan, P., Ed., Zyp, K., and M. Nottingham, Ed., "JavaScript Object Notation (JSON) Pointer", RFC 6901, DOI 10.17487/RFC6901, April 2013, <https://www.rfc-editor.org/rfc/rfc6901>.

[INPUTS]

McGuinness, K., "Agent Resolution Inputs for Agent Principal Federation", Work in Progress, Internet-Draft, draft-mcguinness-oauth-governed-agent-inputs, 9 October 2026, <https://mcguinness.github.io/agent-principal-profiles/draft-mcguinness-oauth-governed-agent-inputs.html>.

[BCP14]

Best Current Practice 14, <https://www.rfc-editor.org/info/bcp14>.
At the time of writing, this BCP comprises the following:

Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997, <https://www.rfc-editor.org/info/rfc2119>.

Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, May 2017, <https://www.rfc-editor.org/info/rfc8174>.

12.2. Informative References

[LIFECYCLE]

McGuinness, K., "Agent Principal Lifecycle Profile for SCIM and OAuth", Work in Progress, Internet-Draft, draft-mcguinness-oauth-governed-agent-lifecycle, 18 September 2026, <https://mcguinness.github.io/agent-principal-profiles/draft-mcguinness-oauth-governed-agent-lifecycle.html>.

[GUIDE]

McGuinness, K., "Implementer's Guide for Agent Principal Federation", <https://github.com/mcguinness/agent-principal-profiles/blob/main/IMPLEMENTERS-GUIDE.md>.

A.1. Obtain the OAuthClient Reference

The connector first obtains an authorized OAuthClient under [OAUTH-CLIENT]. It can reference an existing registration, create one with separate permission, or admit a CIMD client. Client authentication and token-exchange metadata are established by that profile, not by the agent-management requests below.¶

For this example, the client is already active and has:¶

The connector can find an existing resource with the filter authorizationServer eq "https://idp.example/" and clientId eq "platform-sso", URI-encoded in a collection request. It uses oc7 in relationships and platform-sso at the token endpoint. For a CIMD client, the filter and OAuth requests use the Client Identifier URL instead; relationship requests still use the returned SCIM id.¶

A.2. Create an Inactive Agent

POST /scim/acme/Agents HTTP/1.1
Host: idp.example
Authorization: Bearer CONNECTOR_ACCESS_TOKEN
Content-Type: application/scim+json
Accept: application/scim+json

{
  "schemas": [
    "urn:ietf:params:scim:schemas:core:2.0:Agent",
  "urn:ietf:params:scim:schemas:extension:agent-federation:2.0:Agent"
  ],
 "urn:ietf:params:scim:schemas:extension:agent-federation:2.0:Agent":
    {},
  "externalId": "agent-7",
  "agentUserName": "analysis-agent-7",
  "displayName": "Analysis agent",
  "active": false
}

The required extension is populated by the server:¶

HTTP/1.1 201 Created
Location: https://idp.example/scim/acme/Agents/a17
ETag: W/"a1"
Content-Type: application/scim+json

{
  "schemas": [
    "urn:ietf:params:scim:schemas:core:2.0:Agent",
  "urn:ietf:params:scim:schemas:extension:agent-federation:2.0:Agent"
  ],
  "id": "a17",
  "externalId": "agent-7",
  "agentUserName": "analysis-agent-7",
  "displayName": "Analysis agent",
  "active": false,
 "urn:ietf:params:scim:schemas:extension:agent-federation:2.0:Agent":
    {
    "issuer": "https://idp.example/",
    "subject": "agent-42"
  },
  "meta": {
    "resourceType": "Agent",
    "created": "2026-09-18T12:00:00Z",
    "lastModified": "2026-09-18T12:00:00Z",
    "version": "W/\"a1\"",
    "location": "https://idp.example/scim/acme/Agents/a17"
  }
}

The platform's agent-7, SCIM's a17, and the IdP's agent-42 have separate roles. Only (https://idp.example/, agent-42) is the federated Agent Principal identity.¶

A.3. Bind the Workload Identity

POST /scim/acme/AgentIdentityBindings HTTP/1.1
Host: idp.example
Content-Type: application/scim+json

{
  "schemas": [
    "urn:ietf:params:scim:schemas:core:2.0:AgentIdentityBinding"
  ],
  "externalId": "platform-binding-7",
  "agent": {"value": "a17"},
  "credentialClass": "platform-jwt",
  "sourceAuthority": "https://platform.example/",
  "sourceSubject": "workload-7",
  "active": true
}

The IdP authorizes the relationship and returns 201 Created with the resource representation, id: b9, ETag W/"b1", and its Location. The binding is active, but the inactive Agent prevents issuance.¶

A.4. Authorize Client Use

POST /scim/acme/AgentClientAssociations HTTP/1.1
Host: idp.example
Content-Type: application/scim+json

{
  "schemas": [
    "urn:ietf:params:scim:schemas:core:2.0:AgentClientAssociation"
  ],
  "externalId": "platform-association-7",
  "binding": {"value": "b9"},
  "client": {"value": "oc7"},
  "active": true
}

The IdP returns 201 Created with the resource representation, id: c3, ETag W/"c1", and its Location. The reference oc7 resolves to OAuth client platform-sso; it does not replace that client's identity at the token endpoint. This permission does not supply a user subject credential, consent, or target-resource authority.¶

A.5. Enable the Agent

PATCH /scim/acme/Agents/a17 HTTP/1.1
Host: idp.example
Content-Type: application/scim+json
If-Match: W/"a1"

{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
  "Operations": [
    {"op": "replace", "path": "active", "value": true}
  ]
}

The IdP returns 204 No Content with ETag W/"a2" after applying the authorized change. Subsequent token exchanges can now resolve workload-7 through b9 to agent-42, and verify client permission through c3. The IdP still checks user delegation and target authority before issuing an ID-JAG with act.iss equal to https://idp.example/ and act.sub equal to agent-42.¶

A.6. Recover a Lost Creation Response

The connector can recover the Agent resource using its correlation value:¶

GET /scim/acme/Agents?filter=externalId%20eq%20%22agent-7%22 HTTP/1.1
Host: idp.example
Accept: application/scim+json

An authorized query returns a SCIM ListResponse containing a17. The connector verifies the record before continuing. A racing duplicate POST receives 409 with scimType: uniqueness, not another principal.¶

A.7. Find Bindings and Dependencies

A binding lookup can use agent.value eq "a17" and active eq true. To find dependencies of OAuthClient oc7, query both relationship collections with client.value eq "oc7". This finds dedicated-client bindings and all associations naming that client. External-identity bindings have no client attribute; their client permissions are found through associations. For an Agent subject lookup, the attribute name is the extension schema URI followed by :subject, with the expression eq "agent-42". The connector URI-encodes the complete filter under SCIM's query rules.¶

A.8. Disable One Binding

PATCH /scim/acme/AgentIdentityBindings/b9 HTTP/1.1
Host: idp.example
Content-Type: application/scim+json
If-Match: W/"b1"

{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
  "Operations": [
    {"op": "replace", "path": "active", "value": false}
  ]
}

After a successful response, new grant-authorization decisions cannot use b9. Association c3 remains recorded but cannot override the disabled binding. Another independently approved binding can still resolve agent-42. Previously issued tokens are not revoked by this SCIM operation.¶

A.9. Rejection and Boundary Examples

C.1. AgentFederation Schema

{
  "schemas": [
    "urn:ietf:params:scim:schemas:core:2.0:Schema"
  ],
  "id":
 "urn:ietf:params:scim:schemas:extension:agent-federation:2.0:Agent",
  "name": "AgentFederation",
  "attributes": [
    {
      "name": "issuer",
      "description":
        "Governing IdP issuer from the provisioning context.",
      "type": "string",
      "multiValued": false,
      "required": false,
      "mutability": "readOnly",
      "returned": "default",
      "caseExact": true,
      "uniqueness": "none"
    },
    {
      "name": "subject",
      "description":
        "Stable Agent Principal identifier in the IdP namespace.",
      "type": "string",
      "multiValued": false,
      "required": true,
      "mutability": "readOnly",
      "returned": "default",
      "caseExact": true,
      "uniqueness": "none"
    }
  ]
}

C.2. AgentIdentityBinding Schema

{
  "schemas": [
    "urn:ietf:params:scim:schemas:core:2.0:Schema"
  ],
  "id": "urn:ietf:params:scim:schemas:core:2.0:AgentIdentityBinding",
  "name": "AgentIdentityBinding",
  "attributes": [
    {
      "name": "agent",
      "description": "Agent resolved through this identity binding.",
      "type": "complex",
      "multiValued": false,
      "required": true,
      "mutability": "immutable",
      "returned": "default",
      "subAttributes": [
        {
          "name": "value",
          "description": "SCIM id of the referenced resource.",
          "type": "string",
          "multiValued": false,
          "required": true,
          "mutability": "immutable",
          "returned": "default",
          "caseExact": true,
          "uniqueness": "none"
        },
        {
          "name": "$ref",
          "description":
           "Service-provider reference to the target SCIM resource.",
          "type": "reference",
          "multiValued": false,
          "required": false,
          "mutability": "readOnly",
          "returned": "default",
          "caseExact": true,
          "uniqueness": "none",
          "referenceTypes": [
            "Agent"
          ]
        },
        {
          "name": "display",
          "description":
            "Human-readable label; never an identity lookup key.",
          "type": "string",
          "multiValued": false,
          "required": false,
          "mutability": "readOnly",
          "returned": "default",
          "caseExact": false,
          "uniqueness": "none"
        }
      ]
    },
    {
      "name": "credentialClass",
      "description":
        "Credential class used to resolve the Agent Principal.",
      "type": "string",
      "multiValued": false,
      "required": true,
      "mutability": "immutable",
      "returned": "default",
      "caseExact": true,
      "uniqueness": "none",
      "canonicalValues": [
        "dedicated-client",
        "spiffe-jwt",
        "spiffe-wit",
        "spiffe-x509",
        "client-attestation",
        "platform-jwt"
      ]
    },
    {
      "name": "client",
      "description":
        "OAuthClient authorized to use this identity binding.",
      "type": "complex",
      "multiValued": false,
      "required": false,
      "mutability": "immutable",
      "returned": "default",
      "subAttributes": [
        {
          "name": "value",
          "description": "SCIM id of the referenced resource.",
          "type": "string",
          "multiValued": false,
          "required": true,
          "mutability": "immutable",
          "returned": "default",
          "caseExact": true,
          "uniqueness": "none"
        },
        {
          "name": "$ref",
          "description":
           "Service-provider reference to the target SCIM resource.",
          "type": "reference",
          "multiValued": false,
          "required": false,
          "mutability": "readOnly",
          "returned": "default",
          "caseExact": true,
          "uniqueness": "none",
          "referenceTypes": [
            "OAuthClient"
          ]
        },
        {
          "name": "display",
          "description":
            "Human-readable label; never an identity lookup key.",
          "type": "string",
          "multiValued": false,
          "required": false,
          "mutability": "readOnly",
          "returned": "default",
          "caseExact": false,
          "uniqueness": "none"
        }
      ]
    },
    {
      "name": "sourceAuthority",
      "description":
        "Preconfigured authority for the external identity.",
      "type": "string",
      "multiValued": false,
      "required": false,
      "mutability": "immutable",
      "returned": "default",
      "caseExact": true,
      "uniqueness": "none"
    },
    {
      "name": "sourceSubject",
      "description":
        "Exact external identity under the source authority.",
      "type": "string",
      "multiValued": false,
      "required": false,
      "mutability": "immutable",
      "returned": "default",
      "caseExact": true,
      "uniqueness": "none"
    },
    {
      "name": "selectors",
      "description":
        "Additional exact platform-JWT claim constraints.",
      "type": "complex",
      "multiValued": true,
      "required": false,
      "mutability": "immutable",
      "returned": "default",
      "subAttributes": [
        {
          "name": "path",
          "description":
            "JSON Pointer to a claim in the JWT Claims Set.",
          "type": "string",
          "multiValued": false,
          "required": true,
          "mutability": "immutable",
          "returned": "default",
          "caseExact": true,
          "uniqueness": "none"
        },
        {
          "name": "value",
          "description":
            "Expected exact string value of the selected JWT claim.",
          "type": "string",
          "multiValued": false,
          "required": true,
          "mutability": "immutable",
          "returned": "default",
          "caseExact": true,
          "uniqueness": "none"
        }
      ]
    },
    {
      "name": "clientInstanceId",
      "description":
        "Exact client_instance_id of a managed installation.",
      "type": "string",
      "multiValued": false,
      "required": false,
      "mutability": "immutable",
      "returned": "default",
      "caseExact": true,
      "uniqueness": "none"
    },
    {
      "name": "receiverScope",
      "description":
        "IdP Receiver Scope of the client instance identifier.",
      "type": "string",
      "multiValued": false,
      "required": false,
      "mutability": "immutable",
      "returned": "default",
      "caseExact": true,
      "uniqueness": "none"
    },
    {
      "name": "active",
      "description":
       "Administrative enablement; other policy checks still apply.",
      "type": "boolean",
      "multiValued": false,
      "required": true,
      "mutability": "readWrite",
      "returned": "default"
    }
  ]
}

C.3. AgentClientAssociation Schema

{
  "schemas": [
    "urn:ietf:params:scim:schemas:core:2.0:Schema"
  ],
  "id":
    "urn:ietf:params:scim:schemas:core:2.0:AgentClientAssociation",
  "name": "AgentClientAssociation",
  "attributes": [
    {
      "name": "binding",
      "description":
        "External-identity binding the client may use for ID-JAG.",
      "type": "complex",
      "multiValued": false,
      "required": true,
      "mutability": "immutable",
      "returned": "default",
      "subAttributes": [
        {
          "name": "value",
          "description": "SCIM id of the referenced resource.",
          "type": "string",
          "multiValued": false,
          "required": true,
          "mutability": "immutable",
          "returned": "default",
          "caseExact": true,
          "uniqueness": "none"
        },
        {
          "name": "$ref",
          "description":
           "Service-provider reference to the target SCIM resource.",
          "type": "reference",
          "multiValued": false,
          "required": false,
          "mutability": "readOnly",
          "returned": "default",
          "caseExact": true,
          "uniqueness": "none",
          "referenceTypes": [
            "AgentIdentityBinding"
          ]
        },
        {
          "name": "display",
          "description":
            "Human-readable label; never an identity lookup key.",
          "type": "string",
          "multiValued": false,
          "required": false,
          "mutability": "readOnly",
          "returned": "default",
          "caseExact": false,
          "uniqueness": "none"
        }
      ]
    },
    {
      "name": "client",
      "description":
        "OAuthClient authorized to use this identity binding.",
      "type": "complex",
      "multiValued": false,
      "required": true,
      "mutability": "immutable",
      "returned": "default",
      "subAttributes": [
        {
          "name": "value",
          "description": "SCIM id of the referenced resource.",
          "type": "string",
          "multiValued": false,
          "required": true,
          "mutability": "immutable",
          "returned": "default",
          "caseExact": true,
          "uniqueness": "none"
        },
        {
          "name": "$ref",
          "description":
           "Service-provider reference to the target SCIM resource.",
          "type": "reference",
          "multiValued": false,
          "required": false,
          "mutability": "readOnly",
          "returned": "default",
          "caseExact": true,
          "uniqueness": "none",
          "referenceTypes": [
            "OAuthClient"
          ]
        },
        {
          "name": "display",
          "description":
            "Human-readable label; never an identity lookup key.",
          "type": "string",
          "multiValued": false,
          "required": false,
          "mutability": "readOnly",
          "returned": "default",
          "caseExact": false,
          "uniqueness": "none"
        }
      ]
    },
    {
      "name": "active",
      "description":
       "Administrative enablement; other policy checks still apply.",
      "type": "boolean",
      "multiValued": false,
      "required": true,
      "mutability": "readWrite",
      "returned": "default"
    }
  ]
}

C.4. Resource Types

{
  "schemas": [
    "urn:ietf:params:scim:schemas:core:2.0:ResourceType"
  ],
  "id": "Agent",
  "name": "Agent",
  "endpoint": "/Agents",
  "schema": "urn:ietf:params:scim:schemas:core:2.0:Agent",
  "schemaExtensions": [
    {
      "schema":
 "urn:ietf:params:scim:schemas:extension:agent-federation:2.0:Agent",
      "required": true
    }
  ]
}

{
  "schemas": [
    "urn:ietf:params:scim:schemas:core:2.0:ResourceType"
  ],
  "id": "AgentIdentityBinding",
  "name": "AgentIdentityBinding",
  "endpoint": "/AgentIdentityBindings",
  "schema":
    "urn:ietf:params:scim:schemas:core:2.0:AgentIdentityBinding"
}

{
  "schemas": [
    "urn:ietf:params:scim:schemas:core:2.0:ResourceType"
  ],
  "id": "AgentClientAssociation",
  "name": "AgentClientAssociation",
  "endpoint": "/AgentClientAssociations",
  "schema":
    "urn:ietf:params:scim:schemas:core:2.0:AgentClientAssociation"
}