draft-chen-oauth-agent-revocation

OAuth 2.0 Agent Authorization Explicit Revocation

groupnone stateactive pages9 rev00 expires2026-10-29 canonicalhttps://datatracker.ietf.org/doc/draft-chen-oauth-agent-revocation/
The OAuth 2.0 Token Revocation mechanism defined in RFC 7009 enables clients to notify authorization servers that a token is no longer needed. However, that mechanism is limited to single-token operations and does not support batch revocation, cascade propagation, or context-aware semantics at the agent level. With the emergence of autonomous systems and cross-domain agent networks, authorization servers require more granular, traceable revocation semantics. This document defines an agent-based explicit revocation extension, introducing new endpoints, request/response formats, and coordination protocols to support batch revocation based on agent IDs, cascade propagation, conditional revocation, and verifiable audit trails.