@techreport{araut-oauth-transaction-tokens-for-agents-02,
    number =    {draft-araut-oauth-transaction-tokens-for-agents-02},
    type =      {Internet-Draft},
    institution =   {Internet Engineering Task Force},
    publisher = {Internet Engineering Task Force},
    note =      {Work in Progress},
    url =       {https://datatracker.ietf.org/doc/draft-araut-oauth-transaction-tokens-for-agents/02/},
    author =    {Ashay Raut},
    title =     {{Transaction Tokens For Agents}},
    pagetotal = 32,
    year =      2026,
    month =     may,
    day =       21,
    abstract =  {This document specifies an extension to the to support agent context propagation within Transaction Tokens for agent-based workloads. The extension defines the use of the act field to identify the agent performing the action, and leverages the existing sub field (as defined in the base Transaction Tokens specification) to represent the principal. The sub field is populated according to the rules specified in OAUTH-TXN-TOKENS (https://drafts.oauth.net/oauth- transaction-tokens/draft-ietf-oauth-transaction-tokens.html), based on the 'subject\_token' provided in the token request. For autonomous agents operating independently, the sub field represents the agent itself. These mechanisms enable services within the call graph to make more granular access control decisions, thereby enhancing security. This document specifies an extension to OAuth Transaction Tokens OAUTH-TXN-TOKENS (https://drafts.oauth.net/oauth-transaction- tokens/draft-ietf-oauth-transaction-tokens.html) to support agent context propagation within Transaction Tokens for agent-based workloads. The extension defines the agentic\_ctx claim, a structured JWT claim that carries chain-level metadata required for multi-agent flow integrity and MAY contain additional deployment-specific agent context. The extension addresses two deployment patterns: single- agent flows where one agent acts on behalf of a user within a transaction, and multi-agent flows where multiple agents collaborate across a call chain. In multi-agent scenarios, the Transaction Token is replaced at each agent transition by the Transaction Token Service, updating the agentic\_ctx claim while preserving the immutable identity context (sub and act claims) established at transaction initiation. This specification leverages the existing act claim as defined in RFC8693 (https://datatracker.ietf.org/doc/html/rfc8693) and the sub claim as defined in OAUTH-TXN-TOKENS (https://drafts.oauth.net/oauth- transaction-tokens/draft-ietf-oauth-transaction-tokens.html). It does not define new token types or grant types; it operates entirely within the existing Transaction Token issuance and replacement mechanisms defined by the base specification.},
}