Skip to content

Comments

draft-openbotauth-agent-identity-00#6

Merged
hammadtq merged 2 commits intomainfrom
spec/agent-identity-00
Feb 24, 2026
Merged

draft-openbotauth-agent-identity-00#6
hammadtq merged 2 commits intomainfrom
spec/agent-identity-00

Conversation

@hammadtq
Copy link
Contributor

@hammadtq hammadtq commented Nov 27, 2025 •
edited
Loading

This PR adds the first draft of the OpenBotAuth Agent Identity Profile for WBA (draft-openbotauth-agent-identity-01):

  • Defines agent: identifiers and optional sub-agent naming
  • Specifies Signature-Agent as a Structured Field Dictionary pointing to HTTP Message Signatures Directories (JWKS)
  • Introduces the Signature Agent Card at /.well-known/signature-agent-card for metadata
  • Adds optional OpenBotAuth card extensions: oba_agent_id, oba_parent_agent_id, oba_principal
  • Defines OPTIONAL X.509 delegation via x5c/x5u in JWKS
  • Documents the verification flow and security/privacy considerations

Notes:

  • This draft does NOT define ADT (Agent Delegation Tokens) or HTTP 402 semantics; those were removed from the current spec text.

Feedback requested:

  • Is the Signature-Agent dictionary usage aligned with the directory draft expectations?
  • Are the oba_* fields sufficient for agent identity metadata?

@hammadtq hammadtq self-assigned this Nov 27, 2025
@hammadtq
Copy link
Contributor Author

hammadtq commented Dec 17, 2025

I’m revising this draft to align strictly with the current IETF Web Bot Auth drafts (architecture/directory/registry). The previous revision treated Signature-Agent as a single string carrying an OpenBotAuth agent-id and introduced ADT delegation.
Next commits will:
(1) Adopt the structured Signature-Agent dictionary + signature-agent component model.
(2) Require tag="web-bot-auth" + JWK-thumbprint keyid.
(3) Replace ADT with an X.509 delegation profile using JWK x5c/x5u per the Directory draft’s delegation appendix.

@runnerelectrode
Copy link
Contributor

runnerelectrode commented Feb 13, 2026

+1 on this direction. No separate agent JWKS endpoints — agent keys should live in the user's key directory. X.509 cert chains for sub-agent delegation is the right call.

@runnerelectrode runnerelectrode mentioned this pull request Feb 13, 2026
Closed
3 tasks
@hammadtq hammadtq mentioned this pull request Feb 22, 2026
Merged
@hammadtq hammadtq merged commit 007fcc4 into main Feb 24, 2026
1 check passed
@hammadtq hammadtq deleted the spec/agent-identity-00 branch February 24, 2026 14:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@runnerelectrode runnerelectrode Awaiting requested review from runnerelectrode

Assignees

@hammadtq hammadtq

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@hammadtq @runnerelectrode