---
# System prepended metadata

title: Meeting Notes 2026-01-15
tags: [meeting-notes]

---

# Meeting Notes 2026-01-15

## Attendees
* Alex Olivier
* David Brossard
* Atul Tulshibagwale
* Alex Babeanu
* Julio Auto de Medeiros
* George Fletcher
* Victor Lu
* Gert Drapers
* Edmund Jay
* John Jiang

## Agenda
- EIC, Identiverse and other event updates
- Finish off the laundry list of possible directions for this year
- Determine a priority set of items and any willing owners
- Certification progress 
- 

## Notes
- Event Updates
    - Gartner IAM London
        - Just a panel, no room
    - EIC
        - David & Alex B doing 40min session with Gail
        - Run up to EIC podcast (David)
        - AuthZEN standards award EIC
    - Identiverse
        - Panel been submitted, Feb 13th for result
- Prioritizing topics for 2026
    - JSON schema and Open API spec
        - [PR raised by Thomas Tran](https://github.com/openid/authzen/pull/419)
    - Finish partial evaluation API - David? Julio?
        - Julio - Some initial work started
        - No active workstream, clean slate to start from
        - [Partial evaluation proposal / draft](https://hackmd.io/@oidf-wg-authzen/HkLiZVdb1l)
    - Advice/Oligations
        - Some early work - sitting in a PR raised by Alex B
    - MCP/A2A integration - Atul/Alex O/Alex B
    - API gateway integration - Gert. George (reviwer)
        - George - Maybe dependancy on the Advice/Obligations work to have a AuthZEN response trigger some action eg step up AuthN. Take a use case based approach as an allow/deny isn't sufficent in real world scenarios
        - Alex B - could also be relevant for the IdP use case
        - George - and leads to other OAuth use cases (Jeff - AWS, David Hyland have been looking at this wrt RAR)
        - David B - split into two profiles
            - Technical profile at the route level
            - Business profile at the object level
        - George
            - Prior work around defining a pattern to deny a request as early as possible (can subject access the downstream application at all)
            - Nuance from location, history, user profile makes externalization more sane - more about access, less about the specific resource in the specific service
        - Gert
            - coarse-grain at gateway, fine-grain at the application layer. 
            - Different teams and owners. Need to have a similiar understanding of payloads, users etc at both levels for it to be scalable
        - David
            - We could support different levels in the profiles
            - Basic mapping of path, headers etc into AuthZEN request
            - Business/Best practice profiles - outlines specifc types of requests eg get patient request from EHR based on HL7 standard. Profile would further constrain/define the spec based on the standard mapping to AuthZEN feilds
            - Technical profile
        - Gert
            - What is the impact of having profiles on a PDP in terms of how it needs to scale?
        - Alex O/Gert - Start with a scoped example eg REST API?
    - Support different OAuth grant types (token exchange, RAR)
        - Alex B + David + Omri - proposed a RAR profile at IETF, wasn't accepted
        - Gert - start with the gateway vendors to get momentum and then goto IETF
        - [Prior work](https://davidjbrossard.github.io/authzen-rar-profile/draft-brossard-oauth-rar-authzen.html)
- Certification testing (Edmund, Alex B, Gert)
    - Evaluation API is implemented - can be tested now on the certification site
    - Evaluations in progress
    - Interop examples missing some data to implement the full test suite
    - Question about how to make the test data configurable so its not specifically using the interop
    - The current scenarios being used are not clearly defined - needs to be written down to vendors can setup their policies/test data in their PDPs
    - Need a document/data file of the use case - the decision matrix?
    
- To be discussed still:
    - Focusing on adoption
    - Profiles
        - IDP integration
    - Use cases for decentralized enforcement
    - How to centralize policy to leverage a common language model (policy distribution API)
    - Enable human to delegate authZ to AI agents
    - How can OAuth clients reason about the delegated subject's scopes.
    - Building a fuller demo environment that can represent more real world scenarios
    - Shared signals integration scenario
    - Audit log profile



TODO: 
- [x] Alex O: Copy notes to the official wiki:
https://github.com/openid/authzen/wiki/Meetings
- [ ] Review [JSONSchema PR](https://github.com/openid/authzen/pull/419)
- [ ] Alex O: Breakout the interop code into a seperate repo