Meeting Notes 2026‐09 10 - openid/authzen GitHub Wiki

Attendees

  • Alex Olivier
  • Alex Babeanu
  • Atul Tulshibagwale
  • Jeff Lombardo
  • Vladi Berger
  • Omri Gazitt
  • John Jiang
  • Aidan Przygocki - can we ban? (disruptive) - AlexB Reported user
  • Elie
  • Dave Hyland
  • Mike Kiser
  • Alexander Nigl
  • Roland

Agenda

  • Spec Chair Shepherds
  • Errata for Authorization API 1.0
  • Subgroups for specs
  • Certification
  • AOB
    • AlexO: https://openid.net/wg/authzen/ has been updated (will add ARAP/AROP & OAuth next)
    • AlexO: Tristan Swadell (creator of CEL) reached out re-COAZ offering some time
    • AlexB: AuthZEN Adoption in other WG/Groups

Notes

  • Kanywst (https://github.com/kanywst) implemented AuthZen and AROP in OPA: https://github.com/kanywst/opa-authzen-plugin
  • Subgroups, process: how do we tackle it? Alternate-week meetings or additional meetings?
    • [Omri] hopes we can continue the AuthZEN community in the same meeting. Nice to have a critical weekly mass
    • [AlexB] Do we need addional meetings?
    • [Omri] Not advocating for it. Most of the work can be asynchronous. Ad-hoc additional meetings can be setup as needed. Sheppards ask for time at the next meeting.
    • [Karl] ABConnect prior art, look at what they do. Ask Mike.
    • [Jeff] Each subgroup should organize themselves in any way they choose. Report back into the weeklies.
    • [AlexO] Github + issues as central repo
    • [Karl] May make sense to split repos per profile. Makes it clearer, segregates issues, etc..
    • [Omri] We're not at the point of splitting repos yet. No scale issue yet.
    • [Jeff] Notion of "project" in Github. A project can have several repos.
    • [AlexO] Conclusion: keep weeklies. Profiles have shepperds. Single github for now + label.
    • [Karl] Please send the agenda earlier.
    • [Alex's] we're reschedule our planning meetings
    • [AlexO] AuthZEN page updated - Jira. Please send the chairs your work/news/updates. CEL Session in the works, to be planned
    • [AlexB] AuthZEN is not in other WG's radars
    • [Karl] AuthZEN more relevant in refence architectures, e.g., CSA, etc... Pulling everything together is not possible yet: many gaps at all layers. Opportunities for other profiles, e.g., mission, etc
    • [Omri] "no free lunch" - need to learn how to sit in the other's WG processes and work. E.g., MCP & COAZ. on OAuth, Omri had interactions with that WG, post ideas, mailing lists, etc... MCP + OAuth + Gateway community -openAPI- could be prime candidates => find the PEPs and sit with them.
    • [Karl] CSA, NIST,... are really the prime candidates, they speak to the practitionners. Influence NIST.
    • [DavidB] We approached NIST at Axiomatics, 2013/ABAC - XACML + NGAC. NIST Zero Trust paper 2020. Add OWASP to the mix.
    • [Karl] NIST is about to publish smthg for AI
    • [Jeff] Gail has created a relationship with NIST. AuthZEN should be represented as a piece of the puzzle. There won't be 1 RFC to rule them all. Guidance and recommendations. AuthZEn promotion won;t come from the Standard Protocols groups.
    • [DavidB] MCP Inference hook. But also the Workday's, Saleforce's... they don't. know anything about AuthZ. Going through NIST would help steer them.
    • [Karl] Need ref architectures, open source implementations, ... Also more work needed to make it demonstratable that AuthZEN canbe implemented at scale. Not many prove-points, at agent scale. Multi-tenant SaaS at scale, no clear reason why it should be adopted.
    • [Omri] Ref. Arch, agreed. We have the beginning of it in the interop architectures. Need the extra step. ID-JAG: the decision to mint it could be driven by a policy. 1) Could be a good AuthZEN use-case, easier. 2) Getting SaaS's to adopt external AuthZ is hard. 3) actual software vendors would take a long time.
    • [DavidB] The SaaS's are already built on a bunch of AuthZ capabilities. "We want to be the oath of authz", it's a tall order... There are other (vertical) comminities: HIPAA, HL7, FAPI/Financials, ...

Chair Spec Shepherds

SOP: Managing an Adopted Draft in the OpenID AuthZEN Working Group

  • ARAP/AROP - AlexB + DavidB
  • OAuth Binding - AlexO
  • COAZ + Bindings - Atul + AlexO
  • Obligations (inc Negogiation) - AlexB + DavidB
  • (Pending) Policy Store - Julio

Errata process

Anything else we want to fold in?

Tagged issues Open PRs

Subgroups

Proposal: Whole WG meeting alternate weeks

  • Omri: Tried before, hard with fewer people. Expect drafts to evolve outside of the cadance of the meeting and bring issues to the wider WG.

Certification

Couple of issues raised with suite

AOB

  • AlexO: https://openid.net/wg/authzen/ has been updated (will add ARAP/AROP & OAuth next)
  • AlexO: Tristan Swadell (creator of CEL) reached out re-COAZ offering some time
  • AlexB: AuthZEN Adoption in other WG/Groups
    • Karl : AuthZEN is an actor behind a role/protocol eg OAuth. More relevant in the referance arch.