Meeting Notes 2026-02-26

Attendees

• @alexolivier
• @zirotrust
• @davidbrossard
• Mike K
• Edmund Jay
• Julio Auto
• Michael McCoy

Agenda

• Next steps on MCP:
  • COAZ proposal
  • Martin Besozzi's proposal
• Certification scenario update
• Upcoming talks - who else will be there?
  • Gartner IAM London (David, AlexO)
  • EIC (David, AlexB)
• EIC Awards Submission
• OpenID March Newsletter Input

Notes

• MikeK - starting to prototype out AuthZEN for blast radius type checks.

Next steps on MCP

• Atul - ready to go with COAZ proposal, can break out output into a file

Certification scenario update

• Current draft
• Updates
  • Core/Properties split. Every certification level (Basic, Batch, Search) now has two sub-levels. Core tests only use identifier fields. Properties tests require evaluating properties on subjects, resources, and actions.
  • Batch error handling is stricter. The original let PDPs either return decision: false for a failed evaluation or fail the whole request. The new version requires HTTP 200 with the correct number of evaluations - failed items must get decision: false. Only whole-payload failures (malformed JSON, etc.) can return HTTP errors.
  • Discovery certification is now independent. If you're certifying for it, the metadata endpoint must return 200 (404 is a failure). Added not abont tenant-specific paths.
• Open questions
  • Default value merge semantics: The spec says per-evaluation fields "override" top-level defaults, but does not clarify whether override applies at the entity level or sub-field level.
    • Suggestion: Entity-level replacement, not sub-field merge. Keep test advisory.
    • Will overide.
  • Pagination testing depth: Should the harness require PDPs that advertise pagination support to demonstrate multi-page results? This would require a larger fixture to generate enough results for pagination.
    • Suggestion: No, don't require multi-page results for v1
    • Decision: keep out - maybe put a warning
  • Unknown entity types in search: The spec defines search results as "zero or more entities", so empty results for unknown identifiers within known types are clearly valid. However, the spec does not specify behaviour when the entity type itself is unrecognised by the PDP (e.g. searching for type "spaceship"). Should PDPs return an empty results array or HTTP 400
    • Suggestion: Empty results array, not HTTP 400
    • Decision - empty array

Upcoming talks - who else will be there?

• Gartner IAM London (David, AlexO)
• EIC (David, AlexB)
• Identiverse TBD - Atul, AlexO are confirmed
• Authenticate TBD
• EIC Awards Submission

OpenID Newsletter

• Need content by next week

### AOB

• DavidB - A2A patterns emerging with a PDP - do we do a profile?
• George - New DID/VC based approach for MCP identity - should we consider a profile https://modelcontextprotocol-identity.io/

Actions

• AlexO - incorporate cert profile decisions
• Atul - create output of COAZ proposal
• David - send out newsletter