MapGraphSeamsCalendarIntroductionDisclosureMethodFor agents and tools

Updated weekly, new versions on Mondays · Corrections: open an issue

OpenID Foundation AuthZEN Working Group (agent authorization drafts AARP and COAZ)

Independentwork-itemcontext entry

Verified 2026-10-13. Status as of 2026-10-13. All entries.

Seams: S3

Status

AARP and COAZ adopted as Working Group Drafts on 2026-06-15; to be refined through community review and interoperability testing.

Relevance

AARP covers prerequisites such as approvals, consent or attestations before a policy decision; COAZ, the profile for MCP tool authorization, maps information models into the Subject-Action-Resource-Context structure. The OpenID Foundation published a whitepaper, "Identity Management for Agentic AI" (OpenID Foundation page 2025-10-07, arXiv 2510.25819 v1 2025-10-29), on authentication and authorization for AI agents; it "outlines the resources already available for securing today's agents and presents a strategic agenda". The whitepaper names Web Bot Auth, one IETF proposal described as a "passport for agents", and the Agent Payments Protocol (AP2); it does not name UCP, ACP, x402 or TAP (text search, counts in the evidence).

Committed next

None declared in the sources read.

Sources

Overlaps

IETF agentproto (Agent Communication Protocols WG)

Neighbours in the map

Neighbours of OpenID Foundation AuthZEN Working Group (agent authorization drafts AARP and COAZ) in the map Each circle is an entry of the map and links to its page; the colour is the kind of body behind it, a filled circle is a core entry and a dashed circle a context entry. The entry in the middle, with the entries it overlaps and the entries named by the same seams. Overlaps (1)Share a seam (12)IETF agentproto (Agent Communication Protocols WG) (IETF, core)IETF agentproto W3C Agentic Web Working Group (draft charter) (W3C, core)W3C Agentic Web Working… S3 WebMCP (Draft Community Group Report, Web Machine Learning CG) (W3C, context)WebMCP S3 IETF Web Bot Auth (webbotauth WG) (IETF, core)IETF Web Bot Auth S3 x402 (Linux Foundation, core)x402 S3 Browser vendor positions on WebMCP (WebKit, Mozilla, Chrome, Edge) (Independent, core)Browser vendor position… S3 Agentic Commerce Protocol (ACP) (Industry, core)Agentic Commerce Protoc… S3 KYAPay (Skyfire) (Industry, core)KYAPay S3 Mastercard Agent Pay (Industry, core)Mastercard Agent Pay S3 Personal Agent Consent & Trust Protocol (PACT), published by Decagon with Instinct (Industry, core)Personal Agent Consent… S3 Personal Agent Protocol (PAP, "Poppy"), published by Sierra with Meta (Industry, core)Personal Agent Protocol S3 Universal Commerce Protocol (UCP) (Industry, core)Universal Commerce Prot… S3 Visa Trusted Agent Protocol (TAP) (Industry, core)Visa Trusted Agent Prot… S3 OpenID Foundation AuthZEN W…

Solid lines: overlaps declared by one of the two entries. Dashed lines, coloured by seam: entries named by the same seam (S1 to S4) in the seams note. Every node is a link.

Evidence and coverage

Read
The announcement of the drafts (read 2026-10-02 and again 2026-10-13, "Published June 15, 2026") and the working groups page (2026-10-02); the arXiv version and the OpenID whitepaper page, 2026-10-06.
Not read
Authorization API 1.0 Final approval seen only in a search result.
Not found
Not found in the announcement, 2026-10-02: commerce, merchant, product. Counts in the text of the arXiv version, 2026-10-06: Web Bot Auth 8 times (one a reference, one an IETF proposal described as a "passport for agents"), Agent Payments Protocol (AP2) 3, commerce 2 and AuthZEN 1; not found, 2026-10-06: UCP, ACP, x402, TAP.