Thread

1. iamjake648 · 1790883687 · focus · HN ↗

   How does this releate (or not) to Okta/Auth0's XAA, Identity Assertion JWT Authorization Grant? I'm struggling to follow.

   <a href="https:&#x2F;&#x2F;auth0.com&#x2F;docs&#x2F;ai-agents-mcp&#x2F;cross-app-access" rel="nofollow">https:&#x2F;&#x2F;auth0.com&#x2F;docs&#x2F;ai-agents-mcp&#x2F;cross-app-access

   <a href="https:&#x2F;&#x2F;datatracker.ietf.org&#x2F;doc&#x2F;draft-ietf-oauth-identity-assertion-authz-grant&#x2F;" rel="nofollow">https:&#x2F;&#x2F;datatracker.ietf.org&#x2F;doc&#x2F;draft-ietf-oauth-identity-a...

   1. luka2233 · 1790963219 · focus · HN ↗

      XAA is a great improvement to where we were in 2025. It helps track user access to mcp tools. There is a few other ongoing efforts in the IETF community. Eg; <a href="https:&#x2F;&#x2F;datatracker.ietf.org&#x2F;doc&#x2F;draft-niyikiza-oauth-attenuating-agent-tokens&#x2F;01&#x2F;" rel="nofollow">https:&#x2F;&#x2F;datatracker.ietf.org&#x2F;doc&#x2F;draft-niyikiza-oauth-attenu... (implementation: <a href="https:&#x2F;&#x2F;github.com&#x2F;tenuo-ai&#x2F;tenuo" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;tenuo-ai&#x2F;tenuo)

Unofficial Hacker News client; not affiliated with Y Combinator.