Meeting Notes 2026‐03‐05 - openid/authzen GitHub Wiki

Meeting Notes 2026-03-05

Actions from last week
- AlexO - incorporate cert profile decisions
- Atul - create output of COAZ proposal https://github.com/openid/authzen/pull/435
- David - OpenID newsletter content
Open questions on Thomas' OpenAPI PR https://github.com/openid/authzen/pull/419
Certification scenario
- Awaiting feedback from cert team
Upcoming talks - who else will be there?
- Gartner IAM London (David, AlexO)
- EIC (David, AlexB)
- Possible Forrester engagement
- Possible Identiverse session
Publishing profiles - process
- Waiting for advice from Mike L.
EIC Awards Submission
- Submitted on 2/27

DavidB - schema should be as strict as possible.
evaluations is not present -> top-level subject, resource, action MUST be present
- This should be an invalid request
evaluations is array of size 0 -> top-level subject, resource, action MUST be present
- This should be an invalid request
evaluations is array of size > 0 & each object only has subject and resource defined -> top-level action MUST be present
- As long as the flattened/merged sub/act/res is a valid request then it should be allowed otherwise an invalid request
DavidB - we need to add a note to the spec to clarify the merged keys expectations.
Atul - whats the process for formalizing these as OpenID assets?
DavidB - a profile is just a spec, we can pick where its stored.
Edmund - EYC has a similiar JSONSchema output. They put a link to the JSON files but they are not an official part of the spec.
- A machine-readable syntax definition of verified_claims is given as JSON schema in [verified_claims.json], it can be used to automatically validate JSON documents containing a verified_claims element. The provided JSON schema files are a non-normative implementation of this specification and any discrepancies that exist are either implementation bugs or interpretations. https://openid.net/specs/openid-ida-verified-claims-1_0.html#name-base-elements

Martin - can we define the mapping the MCP structure to the AuthZEN request? MCP profile?
AlexB - this should be the first step (maybe part of COAZ?)
Martin - do we have a standard response for an interactive message?
AlexB - obligations should answer this, working on PR