Meeting Notes 2026‐01‐29 - openid/authzen GitHub Wiki

Attendees

• David Brossard
• Alexandre Babeanu
• Vladi Berger
• George Fletcher
• Thomas Hau
• Martin Besozzi
• ...

Agenda

• Actions from last week
  • Alex O: Breakout the interop code into a seperate repo (blocked)
  • JeffB/AO - shutdown interops
  • Review JSONSchema PR
  • Do some digging into other WG that have SDKs
  • Content on getting started with the spec. Revive the use cases track?
  • AO/Edmund - sync on certification and whats needed.
• XACML 3.0 Profile of OpenID AuthZEN 1.0
• SDKs
  • https://github.com/authzen/access
  • .NET SDKfrom RockSolidKnowledge
• EIC Standards Award submission (David) - any others?
• Certification Scenario
• AOB

Roadmap Items

from last week:

• Certification testing (Alex O)
• API Gateway profile (Gert, David)
• MCP/A2A profile (Atul, Alex B)
• Obligations profile (Alex B)
• Partial evaluation (David, Julio)
• Protocol Bindings - gRPC (Gert, Julio)
• Contact external vendors -> Adopt AuthZEN, reach-out

Notes

Interop Apps

• Jeff hosted some interops in AWS for free. We may lose them. Need to check with Jeff + AlexO
• George:
  • need to constantly evaluate the security posture. Should be shut down for security at least.
  • Certification: should not be using interop but proper cert repo
• Owner: @jeffsec and @alexolivier

JSON Schema PR

• Walk thru Thomas's OpenAI spec: needs more work, T will update us

XACML Profile

• XACML binding - map AuthZEN to XACML
• Owner: @davidbrossard
• Looking for volunteers to review the initial text

Partial Evaluation

• Vladi, David, and Julio will pick up the work where we left off last summer.
• See current draft
• Owners: @vladi, @julioauto, @davidbrossard

MCP Apps

Martin:

• adopted everywhere, becomes very important.
• mcp extensions repo: gather recommendations. E.g., cross domain communications -> chat with Aaron Parecki
• See https://github.com/modelcontextprotocol/ext-apps
• Use cases
  • Build PEPs for MCP, MCP API, MCP GW
  • Define access delegation examples/models
• Owner: Martin, @alexbabeanu

Upcoming Events

• Gartner IAM London March 9th 2026
  • The agenda lists the AuthZEN session
• European Identity Conference Berlin May 20th 2026 - we have a few sessions including with OpenID and EIC will likely give us a breakout room for the WG to work.
• David talking to Forrester to see whether they want to host interop events

References

• https://openid.net/specs/openid4vc-high-assurance-interoperability-profile-1_0-05.html

Suggestions for certification

Define a use case

Evaluation API Certification

• Define a well-known request e.g. Alice view record 123

{
    "subject":{"id": "alice", "type": "user"},
    "action":{"name": "view"},
    "resource":{"id": "123", "type": "record" }
}

• Define an expected response e.g. true.

• The PDP must implement the following scenario

  • Policy: Alice can view record 123.

• Given the aforementioned scenario, the following MUST be true:

  • The presence of any field in the properties object of any of the subject/action/resource/context entities must have no bearing on the final decision.
  • The context entity MUST be ignore and cannot have no bearing on the final decision.
  • The order of the entities MUST have no bearing on the final decision.

• Define a well-known request e.g. Alice the manager in Sales can view object 123