@techreport{valverde-oauth-pact-00,
    number =    {draft-valverde-oauth-pact-00},
    type =      {Internet-Draft},
    institution =   {Internet Engineering Task Force},
    publisher = {Internet Engineering Task Force},
    note =      {Work in Progress},
    url =       {https://datatracker.ietf.org/doc/draft-valverde-oauth-pact/00/},
    author =    {Gustavo Valverde},
    title =     {{PACT: Private Agent Consent and Trust Profile for OAuth 2.1 and CIBA}},
    pagetotal = 44,
    year =      2026,
    month =     apr,
    day =       18,
    abstract =  {PACT (Private Agent Consent and Trust Profile) is a security profile of OAuth 2.1 for privacy-preserving agent delegation. It extends VEIL and composes OIDC CIBA Core 1.0 and OAuth Token Exchange (RFC 8693). PACT defines a durable-host plus ephemeral-session control plane, a delegation token claim vocabulary, runtime identity proofs using Ed25519 JWTs, capability grants with typed constraints and usage limits, risk-graduated consent routing, and claim narrowing on token exchange to non-agent audiences.},
}