@techreport{araut-oauth-transaction-tokens-for-agents-03,
    number =    {draft-araut-oauth-transaction-tokens-for-agents-03},
    type =      {Internet-Draft},
    institution =   {Internet Engineering Task Force},
    publisher = {Internet Engineering Task Force},
    note =      {Work in Progress},
    url =       {https://datatracker.ietf.org/doc/draft-araut-oauth-transaction-tokens-for-agents/03/},
    author =    {Ashay Raut},
    title =     {{Transaction Tokens For Agents}},
    pagetotal = 40,
    year =      2026,
    month =     oct,
    day =       31,
    abstract =  {This document specifies an extension to OAuth Transaction Tokens OAUTH-TXN-TOKENS (https://drafts.oauth.net/oauth-transaction-tokens/ draft-ietf-oauth-transaction-tokens.html) to support agent context propagation within Transaction Tokens for agent-based workloads. The extension defines the agentic\_ctx claim, a structured JWT claim that carries chain-level metadata required for multi-agent flow integrity. The extension addresses two deployment patterns: single-agent flows where one agent acts on behalf of a user within a transaction, and multi-agent flows where multiple agents collaborate across a call chain. In multi-agent scenarios, the Transaction Token is replaced at each agent transition by the Transaction Token Service, updating the agentic\_ctx claim while preserving the immutable identity context (sub and act claims) established at transaction initiation. By propagating agent chain context to every service in the call path, this extension enables Resource Servers to implement authorization policies that distinguish agentic execution paths from direct human calls, and provides the transaction lineage required for fine-grained audit trails at the point of data access. Security and compliance teams gain visibility into the downstream operational footprint of an agentic workflow — the full set of services and data stores reached under a single transaction — enabling post-incident reconstruction and bounded assessment of agentic reach. This specification leverages the existing act claim as defined in RFC8693 (https://datatracker.ietf.org/doc/html/rfc8693) and the sub claim as defined in OAUTH-TXN-TOKENS (https://drafts.oauth.net/oauth- transaction-tokens/draft-ietf-oauth-transaction-tokens.html). It does not define new token types or grant types; it operates entirely within the existing Transaction Token issuance and replacement mechanisms defined by the base specification.},
}