draft-coetzee-oauth-spt-txn-tokens

Sovereign Policy Token Transactions (SPT-Txn)

groupnone stateactive pages26 rev01 expires2026-10-29 canonicalhttps://datatracker.ietf.org/doc/draft-coetzee-oauth-spt-txn-tokens/
This document specifies the Sovereign Policy Token Transaction (SPT-Txn) Framework, a token-based architecture for policy-bound, tamper-evident authorization across trust boundaries in agentic and multi-organizational systems. The framework extends IETF Transaction Tokens (RFC 9700) with Capability Acquisition Tokens (CATs) -- cryptographically scoped authorization tokens that bind capability grants to specific transaction contexts, propagate human-origin identity commitments across delegation chains, and support offline verification without issuer interaction. SPT-Txn addresses the gap between coarse-grained bearer token authorization and the fine-grained, auditable, scope-limited authorization required in regulated financial infrastructure, AI agent systems, and cross-organizational transaction chains. The framework provides cryptographic guarantees that every hop in a transaction chain was authorized by a verified human principal, operated within a declared capability scope, and can be audited without exposing personally identifiable information.