ID-JAG
ID-JAG (Identity JWT Authorization Grant) is a JWT-based token mechanism used as an authorization grant credential within OAuth 2.0 flows. It supports both enterprise access control, by conveying verified identity claims, and AI agent registration, by handling delegated authorization for dynamic entities. It supports embedding claims such as act and may_act to maintain traceability across authorization chains.
Timeline (last 90 days)
When designing an identity system, one should first determine whether the problem being solved involves human access or Agent action, and then decide on the token usage and accompanying infrastructure.
ID-JAG is a grant that can be used directly in OAuth 2.0 authorization flows, enabling resource servers to avoid tracing back to the IdP for re-validation each time.
In enterprise access scenarios, ID-JAG carries an explicit, static principal identity, typically corresponding to an employee, service account, or known application.
ID-JAG can embed claims such as act (actor) or may_act in the token payload to identify which principal authorized the Agent and on behalf of which user it is acting.
Enterprise access scenarios and Agent registration scenarios differ fundamentally in trust model, lifecycle management, and authorization semantics.
Mixing a static permission model with a dynamic Agent policy engine can very easily produce over-privileged grant issues.
ID-JAG (Identity JWT Authorization Grant) is a token mechanism applied to both enterprise access control and AI Agent registration.
ID-JAG is typically built on top of OAuth 2.0 Token Exchange (RFC 8693).
The ID-JAG flow involves an application first obtaining an identity assertion from an identity provider, then using that assertion to exchange for an access token targeting a specific resource server, with enterprise authorization policies enforced during the exchange.
In the ID-JAG model, enterprise administrators pre-configure which applications can access which resources, under what conditions, and with what scope, and the identity provider issues tokens containing authorization assertions based on these pre-set policies.
2 more timeline events
All Facts (12)
When designing an identity system, one should first determine whether the problem being solved involves human access or Agent action, and then decide on the token usage and accompanying infrastructure.
50%UnverifiedID-JAG is a grant that can be used directly in OAuth 2.0 authorization flows, enabling resource servers to avoid tracing back to the IdP for re-validation each time.
50%UnverifiedIn enterprise access scenarios, ID-JAG carries an explicit, static principal identity, typically corresponding to an employee, service account, or known application.
50%UnverifiedID-JAG can embed claims such as act (actor) or may_act in the token payload to identify which principal authorized the Agent and on behalf of which user it is acting.
50%UnverifiedEnterprise access scenarios and Agent registration scenarios differ fundamentally in trust model, lifecycle management, and authorization semantics.
50%UnverifiedMixing a static permission model with a dynamic Agent policy engine can very easily produce over-privileged grant issues.
50%UnverifiedID-JAG (Identity JWT Authorization Grant) is a token mechanism applied to both enterprise access control and AI Agent registration.
50%UnverifiedID-JAG is typically built on top of OAuth 2.0 Token Exchange (RFC 8693).
50%UnverifiedThe ID-JAG flow involves an application first obtaining an identity assertion from an identity provider, then using that assertion to exchange for an access token targeting a specific resource server, with enterprise authorization policies enforced during the exchange.
50%UnverifiedIn the ID-JAG model, enterprise administrators pre-configure which applications can access which resources, under what conditions, and with what scope, and the identity provider issues tokens containing authorization assertions based on these pre-set policies.
50%UnverifiedUnder the ID-JAG model, MCP servers need to transition from passive resource endpoints that accept access tokens to active, verification-capable participants in the enterprise authorization system.
50%UnverifiedID-JAG is an abbreviation for Identity Assertion Authorization Grant, representing an authorization paradigm that shifts authorization decisions from end-user consent actions to centralized control under an enterprise identity provider.
50%