- From: Paola Di Maio <paoladimaio10@gmail.com>
- Date: Wed, 27 May 2026 20:10:37 +0800
- To: Aaron Parecki <aaron@parecki.com>
- Cc: public-agentprotocol <public-agentprotocol@w3.org>, public-webagents <public-webagents@w3.org>, W3C AIKR CG <public-aikr@w3.org>
- Message-ID: <CAMXe=So75q_rLfY8z9oDnwZdwpYfbyR5JatgKNFpWjsAhvvjCA@mail.gmail.com>
Thank you Aaron, yes. Is the overview below describing a possible divergence in the landscape right? Let us know what you make f it thanks PDM Gap Analysis The emerging AI-agent identity stack is converging around two historically separate standards ecosystems: the IETF/OAuth authorization model and the W3C verifiable credential/decentralized identity model. Projects such as auth.md illustrate this convergence clearly. auth.md is architecturally aligned with OAuth, HTTP metadata discovery, and IETF identity assertions rather than W3C DID/VC specifications, yet it is attempting to solve adjacent problems: portable machine identity, delegated authority, trust propagation, and interoperable agent registration. This creates a growing standards gap. The current IETF stack is highly effective for authentication, authorization, delegated access, enterprise federation, and API-native workflows, but it is weaker at portable attestations, long-lived trust portability, and cross-domain machine reputation. Conversely, the W3C VC/DID ecosystem is strong at credential portability and cryptographic attestations but comparatively weak in operational enterprise deployment, authorization semantics, and large-scale service interoperability. The practical implication is that AI agents increasingly require both models simultaneously. An autonomous agent may need to authenticate to APIs via OAuth, carry signed organizational credentials, prove delegated authority, expose machine-readable metadata, maintain portable reputation, and support cryptographically verifiable provenance across domains. No single standards family currently provides a complete solution. As a result, the most strategically important area is not competition between the IETF and W3C ecosystems, but interoperability between them. The likely direction of travel is a hybrid architecture in which OAuth/OIDC and emerging IETF identity drafts govern operational access control, while verifiable credentials and selective disclosure mechanisms govern portable assertions and trust claims. The commercial market already appears to be converging around pragmatic interoperability rather than ideological “pure” decentralization or fully centralized platform identity. Functional Area IETF / OAuth Ecosystem W3C VC / DID Ecosystem Emerging Gap Authentication Strong Limited Low API Authorization Strong Weak Medium Delegated Access Strong Partial Medium Portable Credentials Partial Strong High Machine/Agent Identity Emerging Emerging High Enterprise Federation Strong Weak Medium Reputation / Provenance Weak Partial High Metadata Discovery OAuth metadata DID resolution Converging Selective Disclosure Emerging (SD-JWT) Strong Narrowing Operational Deployment Mature Fragmented High The key strategic insight is that AI agents are collapsing the historical separation between identity, authorization, credentials, and trust infrastructure. This is forcing convergence between ecosystems that previously evolved independently and sometimes antagonistically. The most successful future standards are therefore unlikely to be exclusively “OAuth-native” or exclusively “DID-native.” Instead, they will probably combine OAuth-grade operational interoperability with verifiable credential portability and cryptographic trust assertions. Projects such as auth.md are early indicators of this convergence pattern, even if they currently position themselves primarily within the IETF/OAuth lineage rather than the W3C identity ecosystem. On Mon, May 25, 2026 at 10:28 PM Aaron Parecki <aaron@parecki.com> wrote: > This is based on this OAuth draft: > > > https://datatracker.ietf.org/doc/draft-ietf-oauth-identity-assertion-authz-grant/ > > > > > On Mon, May 25, 2026 at 7:22 AM Paola Di Maio <paola.dimaio@gmail.com> > wrote: > >> Greetings everyone >> >> I am simply keeping an eye out on thiings and have come across this >> https://github.com/workos/auth.md >> >> I wonder, how does this relate to everything else we are >> discussing/doing/observing in this space? >> >> My understanding is that this is an emerging protocol proposal that may >> be relevant to ongoing discussions around federated identity, delegated >> authorization, verifiable credentials, and autonomous software agents but >> not a W3C thing >> Please feel free to share with related CGs >> >> brief analysis: >> >> “auth.md”, an OAuth-based agent registration and authorization approach >> intended for autonomous AI agents operating without traditional >> browser-mediated consent flows. >> >> What makes this notable is not necessarily the specific proposal itself, >> but the architectural gap it exposes: >> >> Current OAuth/OIDC assumptions are heavily browser- and human-centric: >> >> - >> >> redirect-based consent >> - >> >> interactive authorization >> - >> >> session-oriented mediation >> - >> >> user-present trust boundaries >> >> Autonomous agents introduce different requirements: >> >> - >> >> long-lived delegated authority >> - >> >> non-interactive authorization >> - >> >> machine-verifiable delegation chains >> - >> >> portable trust assertions >> - >> >> agent-scoped identity distinct from user identity >> - >> >> policy-constrained autonomous execution >> >> The proposal appears to combine: >> >> - >> >> OAuth Protected Resource Metadata >> - >> >> signed identity assertions >> - >> >> machine-readable discovery metadata >> - >> >> delegated authorization semantics for agents >> >> This seems highly adjacent to: >> >> - >> >> FedID discussions around federated assertions and browser mediation >> - >> >> VC/DID work on portable cryptographic identity >> - >> >> emerging “agent identity” and “agent authorization” efforts across >> OpenID, DIF, and IETF communities >> >> One particularly interesting aspect is the use of discoverable metadata >> (“auth.md”) as a capability advertisement layer for agent onboarding and >> authorization. >> >> I suspect we are beginning to see a broader standards gap emerge between: >> >> - >> >> “users using software” >> and >> - >> >> “software acting autonomously under delegated authority” >> >> Questions I think may be worth discussing: >> >> - >> >> Are OAuth/OIDC extensions sufficient for agent-native delegation? >> - >> >> Should agent identity be modeled independently from user identity? >> - >> >> What role should VC/DID infrastructure play in portable agent trust? >> - >> >> How should revocation and policy constraints operate for long-lived >> autonomous agents? >> - >> >> Do we need standardized discovery metadata for agent authorization >> capabilities? >> >> Relevant references: >> >> - >> >> https://workos.com/auth-md >> - >> >> https://workos.com/blog/agent-registration-with-auth-md >> - >> >> https://www.w3.org/groups/wg/fedid/ >> - >> >> https://www.w3.org/community/credentials/ >> >> Curious whether others see this as: >> >> - >> >> an implementation detail, >> - >> >> an OAuth extension opportunity, >> or >> - >> >> the beginning of a broader agent identity/authz standardization >> problem. >> >> >>
Received on Wednesday, 27 May 2026 12:11:20 UTC