Mission-Bound Runtime Enforcement for OAuth 2.0

1.1. Relationship to the issuance profile

This document depends normatively on the issuance profile and is not implementable alone: it consumes Mission-bound access tokens that profile defines. It does not place any new requirement back on the issuance profile; it reads only fields that profile already defines:¶

• the mission claim (id, origin, authority_hash);¶

• the token's authorization_details, including entries of type mission_resource_access (resource, actions, constraints, and any delegation member) and any other entry type the deployment supports under the issuance profile's rules;¶

• the act chain, when delegation is in effect;¶

• the standard iss, aud, sub, client_id, and exp claims, when present in the token format; and¶

• any cnf sender-constraint binding.¶

Where this document needs a value the token does not carry (the current Mission lifecycle state, or a materialized policy-view version), it obtains it at runtime as described below, never by requiring the issuance profile to add a field.¶

The Resource Server enforcement rules in the issuance profile remain the baseline for every Mission-bound access token. This document adds an optional runtime conformance profile for deployments that claim execution-time Mission enforcement; it does not weaken the issuance profile's stateless token-validation, subset, delegation, or constraint-enforcement requirements.¶

3.1. Enforcement flow

 Agent          PEP (action boundary)        PDP
   |                  |                        |
   |- action+params ->|                        |
   |                  | validate token         |
   |                  |- evaluate vs Mission ->|
   |                  |  (authority, params,   |
   |                  |   actor, state)        |
   |                  |<---- permit / deny ----|
   |                  | bind to params;        |
   |                  | write evidence         |
   |<- execute/refuse-|                        |

The PEP first validates the token as described in Section 5. On permit the PEP reverifies the parameter binding, then executes; on deny it refuses. The runtime decision evaluates the action against the Mission's authority, the entry constraints, the actor chain, the Mission's current state, and Resource policy, as defined in Section 6.¶

3.2. Enforcement scope and conformance

This profile is implemented by a runtime deployment, not by an OAuth Authorization Server alone. Three things conform, at different granularities: the runtime deployment (this section), the Resource Server runtime profile for OAuth-protected resources (Section 4), and the PEP/PDP decision path for each consequential action (Section 6). Conformance is not global to a product, Authorization Server, Resource Server, or PDP: a deployment conforms to this profile only for the resources, action classes, execution paths, and authorization-detail types named in its enforcement scope.¶

A deployment that claims conformance to this profile MUST document its enforcement scope, including:¶

• the protected resources, action classes, and execution paths it mediates;¶

• the PEP locations that can prevent those actions;¶

• the PDP or PDPs that evaluate Mission-bound decisions;¶

• the authorization_details types, action identifiers, and constraint vocabularies it supports;¶

• any Resource Server runtime profile and operation profiles it uses (Section 4);¶

• the Mission state source and maximum staleness bound used for each action class (Section 6.1);¶

• the runtime enforcement evidence mechanism and retention window (Section 10); and¶

• any consumption-metering consistency bound it advertises (Section 8).¶

A deployment MUST NOT claim runtime enforcement for a resource, action class, authorization_details type, or execution path outside that declared scope. A Mission Issuer conforms to the issuance profile; it does not become a runtime-conforming deployment merely by issuing Mission-bound tokens.¶

The enforcement scope is a deployment conformance statement, not an OAuth Authorization Server metadata extension. This document defines no discovery mechanism, registry, or wire format for publishing it. Different deployments can document scope through configuration, operational policy, resource-server metadata defined elsewhere, or a contractual profile.¶

3.3. Action classification

The boundary between consequential and non-consequential actions is deployment policy, but a deployment MUST NOT define it so loosely that nothing is enforced. This document defines a default classification a deployment SHOULD adopt, and a floor it MUST observe.¶

The table's per-class requirements (the PDP gate and parameter binding) are requirements for an action once it is assigned to that class. Assigning an action to a class is deployment policy, bounded by the floor below and by any Resource-policy minimum (Section 6): the profile does not require every read to reach a PDP. A read that is already fully constrained by the token's audience, resource, and the Resource Server's object-level authorization, and that does not materially affect the resource set or disclosure risk, need not be classified a consequential read, and is then not separately PDP-gated by this profile. A deployment MUST NOT, however, use classification to evade the floor or a Resource-policy minimum, and once an action is a consequential write or higher it MUST be gated and bound as the table requires.¶

Classification floor. Actions in the irreversible, external commitment, and privileged administration classes MUST be treated as consequential and gated. These three are the high-consequence classes, to which this profile's strictest requirements attach (action-bound approval (Section 3.4), mediated custody (Section 3.6), active-state freshness (Section 6.1), and execution-outcome evidence (Section 10), each as specified in its own section). A Mission's purpose, or deployment policy, MAY raise an action to a stricter class; it MUST NOT lower an action below any minimum classification the Resource policy (Section 6) sets for it, and in any case MUST NOT classify an irreversible, external-commitment, or privileged-administration action as non-consequential. A deployment that leaves such an action ungated does not enforce this profile for that action's class (Section 3.5).¶

3.4. Action-bound approval

The Mission's approval event ([I-D.draft-mcguinness-oauth-mission]) consents to the task and its authority bound; it does not consent to a specific action's concrete parameters at the point of use. For the highest-consequence classes, a deployment can require a second, action-bound approval: a fresh approval bound to the concrete action and the parameters the PEP is about to permit, distinct from the Mission's initial approval.¶

An action-bound approval is an approval event under the issuance profile bound to the action: it is obtained from an independent Approver or policy authority, never self-issued by the agent or asserted from the agent's own context, and its rendered disclosure MAY be committed as Consent Evidence ([I-D.draft-mcguinness-oauth-mission-consent-evidence]) bound to the action parameters. It composes with, and does not replace, [RFC9470] step-up authentication, which strengthens the actor's authentication context rather than approving a specific action.¶

A PEP MUST refuse an action for which deployment policy or Resource policy requires an action-bound approval and a valid fresh approval bound to the action's parameters is not present. A deployment SHOULD require an action-bound approval for the high-consequence classes, where a token-lifetime-wide standing authority is least appropriate. Because the approval is bound to the concrete parameters, it MUST be reverified under the time-of-check to time-of-use rules of Section 7; a parameter change after approval invalidates it.¶

This profile does not define the wire workflow that obtains the approval. A decision-API binding MAY route the requiring denial through a standardized access-request and approval workflow and carry the resulting approval back as decision input; the AuthZEN binding composes with the AuthZEN Access Request and Approval Profile for exactly this (Section 11). However obtained, the approval is decision input, not a bearer grant: the runtime decision of Section 6 remains authoritative, and a persisted grant beyond the single action is a Mission expansion, not a property of the approval itself.¶

Consequential reads do not require parameter binding by default. However, a deployment MUST bind or digest read parameters when those parameters materially change the effective resource set or disclosure risk. Examples include export-like reads, bulk reads, cross-tenant or cross-account queries, privacy-sensitive filters, field selection that controls sensitive attributes, destination or delivery parameters, and aggregation choices that affect re-identification risk.¶

3.5. PEP placement

Enforcement only works at the component that can actually stop the action. A deployment claiming this profile MUST observe these rules:¶

• The PEP MUST sit at the last controllable boundary before the action. A permit checked further upstream does not survive parameter changes, retries, or routing that happen after the check.¶

• A token-issuance decision does not replace execution-time authorization. A token-only Resource Server cannot claim runtime enforcement; the issuance gate is governance, the runtime gate is enforcement.¶

• A tool-catalog filter does not replace per-call authorization. Filtering a tool list by the caller's authority is exposure control; every consequential tool call MUST still pass the runtime gate.¶

• An orchestrator's internal check does not replace a Resource Server's PEP. Defense in depth is permitted; substitution is not.¶

• If no PEP can prevent the action for a given class, the deployment MUST NOT claim runtime enforcement for that class, and MUST name the action classes and execution paths it does mediate.¶

The boundary varies by action: an OAuth-protected API call is gated at the Resource Server; a consequential MCP tools/call at the MCP server; a local tool invocation, file write, or payment at the orchestrator or whatever component drives the call; external egress at an egress proxy. Where an action can be reached by an unmediated path (a debug shell, an unsanctioned egress route, a direct connector), the profile is not enforced for the classes that path reaches.¶

3.6. Credential custody and mediated execution

In an agentic deployment the agent component is itself part of the attack surface: it may be prompt-injected or compromised. The issuance and runtime gates do not make the agent trustworthy; they bound what it can do. A deployment lowers that bound further by not letting the agent hold the authority whose misuse is unacceptable.¶

Mission-bound tokens are sender-constrained ([I-D.draft-mcguinness-oauth-mission]): whoever holds the sender-constraint private key the token's cnf binds can present the token. Mediated execution is a PEP placement that uses this: for the action classes a deployment mediates, the sender-constraint private key is held by the PEP that sits at the last controllable boundary (Section 3.5), not by the agent component. The agent therefore cannot present the Mission-bound credential directly; to act, it asks the mediating PEP, which runs the decision of Section 6 and only then uses the key. No new token type, credential handle, or wire protocol is introduced: this is a custody and placement property of the existing sender-constraint key. The mediating PEP is a co-trusted process in the agent's own trust domain, not a delegate: the token is unchanged, the agent remains the principal of record (client_id still attributes the action to the agent), and no act-chain entry is added.¶

For an action class it mediates, a deployment SHOULD hold the sender-constraint private key for the Mission-bound credential in the mediating PEP rather than in the agent component, and SHOULD do so for the external-commitment and privileged-administration classes. Two properties follow: a credential exfiltrated from a compromised agent is unusable without the key; and a compromised agent cannot reach a mediated action without passing the per-action check, because it never holds a usable credential for that class. Mediated execution depends on the agent having no unmediated path to the resource; a Mission-aware harness establishes that execution environment ([I-D.draft-mcguinness-oauth-mission-harness]).¶

This narrows, and does not eliminate, the compromised-agent exposure. The mediating PEP becomes a trusted component whose compromise is out of scope here (Section 13); a compromised agent can still request mediated actions, which are gated, and can still misuse any low-consequence authority it legitimately holds directly. The aim is that the agent is structurally unable to take a high-consequence action unilaterally, not that the agent is trusted.¶

The set of action classes a deployment mediates is the load-bearing parameter here: a deployment that mediates nothing gains nothing from this section, however it labels itself. A deployment that relies on this profile to protect against agent compromise therefore MUST include the high-consequence classes in its mediated set; the protection is only as broad as that set.¶

3.7. Agent-compromise-resistant enforcement

"Protects against agent compromise" is a verifiable claim, not a label. A deployment claims agent-compromise-resistant enforcement only when, for the high-consequence classes, all of the following hold (each is SHOULD in the base profile and MUST under this claim):¶

• the sender-constraint private key is held by the mediating PEP, not by the agent component (Section 3.6);¶

• governed work runs with no unmediated path to those actions, as a Mission-aware harness establishes ([I-D.draft-mcguinness-oauth-mission-harness]);¶

• each such action requires an action-bound approval (Section 3.4); and¶

• the Mission state source for those classes is an active freshness mechanism, not token-lifetime expiry (Section 6.1).¶

A deployment that leaves any of these as SHOULD MUST NOT claim agent-compromise-resistant enforcement; it may still claim base runtime conformance. The claim names exactly the set of classes it covers.¶

6.1. Mission state and freshness

A Mission-aware decision needs the Mission's current state, which a token alone does not convey. A runtime deployment MUST define the Mission state source it trusts for each enforcement scope. Examples include origin AS token introspection, a local Mission database, an authenticated status or event feed from the Mission origin, a materialized policy view, or a short-lived cross-domain credential whose lifetime is the deployment's accepted state lease.¶

• The PDP MUST refuse a consequential action when it cannot establish, within the deployment's published staleness bound, that the Mission is active.¶

• A state source MUST either report the Mission state with a freshness time, or define a lease interval over which a previously established active state remains acceptable for the relevant action class. A permit issued from that state view MUST expire no later than the applicable freshness time or lease interval.¶

• When the credential issuer also holds the Mission, the PDP can learn state through token introspection ([RFC7662]) at the issuer per [I-D.draft-mcguinness-oauth-mission]. A non-origin Resource AS introspecting a local token cannot report current Mission state under the issuance profile; it can establish local token validity, but not origin Mission freshness.¶

• This document defines no cross-issuer by-Mission status query. Deployments that need tighter freshness than the token or cross-domain grant lifetime provides use the Mission Status profile ([I-D.draft-mcguinness-oauth-mission-status]) or Mission Lifecycle Signals ([I-D.draft-mcguinness-oauth-mission-signals]), or an out-of-band trusted status feed.¶

• Each enforcement scope MUST publish its maximum staleness bound per action class and state source. This document does not impose one universal value.¶

• For the high-consequence classes, the state source MUST be an active freshness mechanism that can reflect a revocation within the staleness bound: origin token introspection ([RFC7662]), the Mission Status profile ([I-D.draft-mcguinness-oauth-mission-status]), or Mission Lifecycle Signals ([I-D.draft-mcguinness-oauth-mission-signals]). Token-lifetime expiry alone is not an acceptable state source for these classes: it bounds staleness only by the lifetime, so a revoked Mission keeps deriving consequence until tokens age out, which is the ambient-authority gap this profile exists to close.¶

The following non-normative guidance illustrates freshness bounds that are likely to match the risk of common action classes:¶

10.1. Required decision evidence

A record MUST contain:¶

• the decision or refusal result and, on refusal, the failure condition from Section 9;¶

• the request time (RFC 3339 [RFC3339]); and¶

• the parameter_digest for parameter-bound classes, or a privacy-preserving digest of the evaluation request otherwise.¶

A record MUST also contain the following fields when they are available and trusted for the refusal or decision path:¶

• the Mission reference (mission.id, mission.origin) and the authority_hash (and intent_hash when known: it is carried in neither the mission claim nor introspection, so it is available only to a PDP with direct Mission-record access, and most deployments record authority_hash alone) it operated under;¶

• the token issuer and audience or protected-resource identifier when available;¶

• the authenticated sub, client_id, a client-instance identifier (a deployment-defined correlator) when present, the sender-constraint confirmation key when present, and the act chain projection when delegation applies;¶

• the action and resource identifiers (and the asserted capability identity when applicable);¶

• the authorization_details type and authorizing entry, or a digest of that entry when recording the full entry would disclose excess authority or sensitive policy;¶

• the decision identifier, when the PDP produced one; and¶

• the PDP's policy-view version.¶

For a token-validation failure, the record MUST NOT describe unverified token claims as authenticated facts. It MAY include a digest of the presented token or rejected claim set for correlation and forensics, subject to the privacy requirements below.¶

The authority_hash and intent_hash in a record are the originating AS's commitments, cited as anchors; the PDP does not recompute them and is not required to hold the full Authority Set to record them, consistent with [I-D.draft-mcguinness-oauth-mission].¶

10.2. Execution-outcome evidence

For an action in the high-consequence classes, the executing PEP MUST also produce, after it acts, an execution-outcome record keyed to the permit's decision identifier, recording at least success or failure and the parameter_digest actually executed. This lets a decision and its execution be reconciled one to one, so a permit that was obtained but executed more than once, or executed for different parameters, is detectable after the fact. The detailed object schema is deferred (Section 12).¶

10.3. Record integrity and retention

The following requirements apply to every record:¶

• The Resource Server runtime profile MUST define the record's concrete serialization and canonicalization before storage and integrity protection. JSON records SHOULD use JCS [RFC8785] under the issuance profile's canonicalization rules.¶

• It MUST be append-only and integrity-protected; the enforcement scope MUST name the mechanism (a hash-linked log, signed segments, a transparency anchor, or equivalent).¶

• Raw parameters MUST NOT appear in the record; when retained for forensics they MUST be in separately access-controlled storage referenced by an opaque identifier, with only the parameter_digest in the record.¶

• Records for one Mission MUST carry a deployment-defined sequence indicator so decision order can be reconstructed without relying on wall-clock time alone.¶

• The enforcement scope MUST publish a retention window no shorter than the Mission's effective audit horizon.¶

13.1. What this layer adds, and its limits

Gating every consequential action against the current Mission prevents an active Mission from acting as ambient authority: authority is checked at the point of use, parameters are bound to the permit, consumption is metered, and each decision or refusal path is recorded. This closes the approval-to-execution gap the issuance profile leaves open.¶

It does not make a compromised enforcement component safe. A compromised PEP can decline to consult the PDP or ignore its decision; a compromised PDP can return whatever decisions it chooses. Decision and enforcement evidence make such behavior auditable after the fact; they do not prevent it in the moment. Signed, externally verifiable decisions are future work (Section 12).¶

13.2. Placement and bypass

The strongest decision logic is void if the PEP is not at the last controllable boundary, or if an unmediated path can reach the action (Section 3.5). A deployment's claim is only as strong as the set of execution paths it actually mediates; it MUST name that set.¶

13.3. Prompt injection and exfiltration

This profile assumes the agent can be prompt-injected and does not try to prevent that. It constrains what an injected agent can do by gating the external-communication leg: external communication is a consequential action, so every attempt is checked against the Authority Set, bound to parameters, metered, and (with mediated execution, Section 3.6) made unreachable to an agent that does not hold the egress credential. This is the architectural defense, gate the exfiltration against an authority the injection cannot widen, rather than make the agent injection-proof.¶

Two limits are inherent and a deployment MUST NOT overstate the guarantee. First, it is exactly as strong as PEP-placement completeness: every exfiltration channel an agent runtime offers (DNS, logs, error strings, a write to a store another process reads) is a channel that must be mediated, and this profile gates the channels routed through a PEP but cannot prove a deployment enumerated them all (the Achilles' heel of Section 3.5). Second, this profile provides no information-flow control: it evaluates each action in isolation against authority over resources and actions, so a sequence of individually-authorized steps can compose into an exfiltration no single check catches (within-scope data laundering), and max_calls / max_budget bound volume, not flow. Closing that needs a separate taint or information-flow layer. A coarse session-level mitigation, downgrading egress authority once untrusted content has entered a session, is available at the harness layer ([I-D.draft-mcguinness-oauth-mission-harness]); it raises the bar but is not information-flow control.¶

13.4. Relationship to inspection-based controls

Inspection-based runtime defenses for agentic systems share this profile's premise that the agent application is part of the attack surface (Section 3.6), and combine deterministic checks over the message flow with semantic checks over the agent's intent. This profile is the authority half of that picture; it composes with, but does not replace, an inspection layer.¶

Two of this profile's mechanisms are deterministic checks of that kind. Parameter binding (Section 7) ties a permit to the concrete parameters the action executes with, so an application cannot alter a tool call's arguments after the decision. Capability-source binding, in the AuthZEN binding (Section 11), ties an approved action to the digest of the capability definition it was derived from, so a swapped or poisoned tool definition fails the decision. Both refuse the action; neither inspects the agent's reasoning.¶

Two adjacent checks are out of scope (Section 12). This profile evaluates the request path: it does not verify the integrity of the result a tool returns as the application relays it back to the agent's model, so an application can still falsify what the model sees; and it does not by itself establish that an executed action reflects the model's own decision rather than an application substitution. Mediated execution (Section 3.6) bounds the second case, since an action outside the Authority Set is refused however it arose, but it does not bind the executed action to the model's decision; a deployment that can establish that correspondence SHOULD. Both sit at the semantic and grounding boundary the issuance profile names a non-goal ([I-D.draft-mcguinness-oauth-mission]).¶

A semantic intent-alignment signal, for example a judgment that a requested tool fits the task extracted from the conversation, MAY be supplied to the PDP as advisory decision input. Such a signal MAY contribute to a denial; it MUST NOT widen, grant, or refresh authority, consistent with the inert treatment of goal and purpose in the issuance profile ([I-D.draft-mcguinness-oauth-mission]). Gating authority on intent inference is out of scope: verifying an agent's declared reasoning against the task is an attestation problem outside both layers, and intent inference is not reliable enough to be load-bearing for high-consequence authority.¶

13.5. Classification integrity

Because "consequential" is partly deployment-defined, the classification floor of Section 3.3 is load-bearing: a deployment cannot evade enforcement by classifying a high-consequence action as non-consequential. A purpose may raise a class but never lower it below the resource owner's floor.¶

13.6. Freshness and consumption honesty

A permit is a lease, not a standing grant: stale Mission state MUST fail closed for consequential actions within the published bound (Section 6.1). Consumption bounds are exact only under a single serializing PDP; a deployment MUST NOT advertise exactness it cannot meet across distributed decision points (Section 8).¶

13.7. Resource policy remains authoritative

Mission authority is a maximum authority envelope. It does not force a Resource Server to perform an action, bypass local authorization, or override object ACLs, tenant configuration, legal holds, service invariants, or risk policy. A runtime deployment that treats a Mission-bound permit as sufficient without Resource policy evaluation can perform actions that the resource owner or service would otherwise forbid.¶

13.8. TOCTOU and replay

Parameter binding (Section 7) ties a permit to specific normalized parameters and a short window or single use, so a permit cannot be replayed for a different request or survive a parameter change between check and use. The executing PEP, not an upstream component, MUST perform the reverification.¶

13.9. Confused deputy across resources

The permit binding of Section 7 ties a decision to the Mission, the token audience or protected resource, sub, client_id, actor context, action, and resource it evaluated. It follows that a PDP decision for one protected resource, audience, tenant, or operation is not reusable at another: the executing PEP, which reverifies those bindings before acting (Section 7), refuses a permit whose bindings do not match the boundary at which it is presented. A deployment MUST NOT relax those bindings in a way that would let a permit cross a resource, audience, tenant, or operation boundary it was not issued for.¶

13.10. Decision channel and token disclosure

A separate PDP becomes part of the Resource Server's trusted authorization path for the operations in its enforcement scope. The PEP/PDP channel therefore needs mutual authentication, integrity protection, and authorization for the declared scope (Section 5). Passing full access tokens to a PDP also extends credential exposure beyond the Resource Server boundary; a deployment that does so needs the same credential handling, retention, and disclosure controls it applies at the Resource Server.¶

13.11. Evidence privacy and correlation

Runtime enforcement evidence is intentionally durable and therefore sensitive. It can reveal a subject's resources, action timing, delegated actors, and Mission correlation identifier even when raw action parameters are not stored. Deployments SHOULD minimize recorded authority entries, store entry and parameter digests where full values are not needed for audit, restrict access to evidence by role, and document the retention window declared under Section 10. Evidence shared across resource boundaries can also correlate activity by mission.id and authority_hash; deployments that require unlinkability need an additional privacy design outside this profile.¶

General OAuth security guidance [RFC9700] applies to the underlying credentials.¶

15.1. Normative References

[I-D.draft-mcguinness-oauth-mission]

McGuinness, K., "Mission-Bound Authorization for OAuth 2.0", Work in Progress, Internet-Draft, draft-mcguinness-oauth-mission, 2026, <https://datatracker.ietf.org/doc/html/draft-mcguinness-oauth-mission>.

[RFC2119]

Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997, <https://www.rfc-editor.org/rfc/rfc2119>.

[RFC3339]

Klyne, G. and C. Newman, "Date and Time on the Internet: Timestamps", RFC 3339, DOI 10.17487/RFC3339, July 2002, <https://www.rfc-editor.org/rfc/rfc3339>.

[RFC6234]

Eastlake 3rd, D. and T. Hansen, "US Secure Hash Algorithms (SHA and SHA-based HMAC and HKDF)", RFC 6234, DOI 10.17487/RFC6234, May 2011, <https://www.rfc-editor.org/rfc/rfc6234>.

[RFC6749]

Hardt, D., Ed., "The OAuth 2.0 Authorization Framework", RFC 6749, DOI 10.17487/RFC6749, October 2012, <https://www.rfc-editor.org/rfc/rfc6749>.

[RFC6750]

Jones, M. and D. Hardt, "The OAuth 2.0 Authorization Framework: Bearer Token Usage", RFC 6750, DOI 10.17487/RFC6750, October 2012, <https://www.rfc-editor.org/rfc/rfc6750>.

[RFC7662]

Richer, J., Ed., "OAuth 2.0 Token Introspection", RFC 7662, DOI 10.17487/RFC7662, October 2015, <https://www.rfc-editor.org/rfc/rfc7662>.

[RFC8174]

Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, May 2017, <https://www.rfc-editor.org/rfc/rfc8174>.

[RFC8785]

Rundgren, A., Jordan, B., and S. Erdtman, "JSON Canonicalization Scheme (JCS)", RFC 8785, DOI 10.17487/RFC8785, June 2020, <https://www.rfc-editor.org/rfc/rfc8785>.

[RFC9068]

Bertocci, V., "JSON Web Token (JWT) Profile for OAuth 2.0 Access Tokens", RFC 9068, DOI 10.17487/RFC9068, October 2021, <https://www.rfc-editor.org/rfc/rfc9068>.

[RFC9700]

Lodderstedt, T., Bradley, J., Labunets, A., and D. Fett, "Best Current Practice for OAuth 2.0 Security", BCP 240, RFC 9700, DOI 10.17487/RFC9700, January 2025, <https://www.rfc-editor.org/rfc/rfc9700>.

15.2. Informative References

[AUTHZEN]

OpenID Foundation, "OpenID AuthZEN Authorization API 1.0", 2026, <https://openid.net/specs/authorization-api-1_0-final.html>.

[I-D.draft-mcguinness-oauth-mission-authzen]

McGuinness, K., "Mission-Bound Runtime Enforcement: AuthZEN Profile", Work in Progress, Internet-Draft, draft-mcguinness-oauth-mission-authzen, 2026, <https://datatracker.ietf.org/doc/html/draft-mcguinness-oauth-mission-authzen>.

[I-D.draft-mcguinness-oauth-mission-consent-evidence]

McGuinness, K., "Mission Consent Evidence for OAuth 2.0", Work in Progress, Internet-Draft, draft-mcguinness-oauth-mission-consent-evidence, 2026, <https://datatracker.ietf.org/doc/html/draft-mcguinness-oauth-mission-consent-evidence>.

[I-D.draft-mcguinness-oauth-mission-harness]

McGuinness, K., "Mission-Aware Agent Harnesses for OAuth 2.0", Work in Progress, Internet-Draft, draft-mcguinness-oauth-mission-harness, 2026, <https://datatracker.ietf.org/doc/html/draft-mcguinness-oauth-mission-harness>.

[I-D.draft-mcguinness-oauth-mission-signals]

McGuinness, K., "Mission Lifecycle Signals for OAuth 2.0", Work in Progress, Internet-Draft, draft-mcguinness-oauth-mission-signals, 2026, <https://datatracker.ietf.org/doc/html/draft-mcguinness-oauth-mission-signals>.

[I-D.draft-mcguinness-oauth-mission-status]

McGuinness, K., "Mission Status and Lifecycle for OAuth 2.0", Work in Progress, Internet-Draft, draft-mcguinness-oauth-mission-status, 2026, <https://datatracker.ietf.org/doc/html/draft-mcguinness-oauth-mission-status>.

[I-D.draft-niyikiza-oauth-attenuating-agent-tokens]

Aimable, N., "Attenuating Authorization Tokens for Agentic Delegation Chains", Work in Progress, Internet-Draft, draft-niyikiza-oauth-attenuating-agent-tokens-01, 15 June 2026, <https://datatracker.ietf.org/doc/html/draft-niyikiza-oauth-attenuating-agent-tokens-01>.

[RFC9470]

Bertocci, V. and B. Campbell, "OAuth 2.0 Step Up Authentication Challenge Protocol", RFC 9470, DOI 10.17487/RFC9470, September 2023, <https://www.rfc-editor.org/rfc/rfc9470>.