IETF protocol work on OAuth, workloads, and serialization

IETF working groups advanced several authorization, identification, and encoding proposals, with calls for interest, last calls, and adoption discussions drawing technical debate. Activity centered on OAuth fine-grained controls, workload identity, CBOR serializations, DKIM header limits, and PLANTS use cases.

OAuth WG seeks interest in fine-grained authorization

The OAuth working group issued a call for interest in fine-grained authorization, framed as an IETF 126 follow-up and tied to AI agent scenarios. Discussion references existing drafts on missions and RAR remediation. Developers tracking delegated access for constrained or agentic clients should note the direction of this work.

WIMSE gauges interest in third-party workload identification

The WIMSE working group requested expressions of interest in a workload identification problem that avoids per-workload registration for third parties. Members responded positively. The thread matters for operators building identity systems that must scale without registering every workload instance.

CBOR last call on preferred and deterministic serializations

The CBOR working group opened last call on draft-ietf-cbor-serialization-09, ending 2026-10-19, covering preferred-plus and deterministic CBOR serializations. Messages include technical corrections and debate over profiling. Implementers of constrained or deterministic encodings need to review the draft before the deadline.

DKIM2 proposes BCP text on header size limits

A DKIM2 thread proposes BCP operator guidance on header size limits and truncation risks as Message-Instance and DKIM2-Signature fields grow. The note aims to document practical limits for operators. Mail system maintainers should watch for resulting BCP language that could affect signature handling.

PLANTS call for adoption of MTC deploy use-cases draft

The PLANTS working group ran a call for adoption of draft-gray-plants-mtc-deploy-use-cases-01, drawing mixed support across many participants. Some prefer focusing on the core specification first. Readers interested in non-WebPKI machine-to-cloud trust models will want the outcome of this adoption decision.