SCIM for AI agents: what the IETF draft says so far

4 min read · Published 17 October 2026

Companies now run AI agents that hold real access to real systems. There is no standard way to list them. A group of authors from Microsoft, Okta and Nextident has proposed one, built on SCIM.

Short answer

As of 17 October 2026, SCIM for agents is an individual Internet-Draft called draft-wzdk-scim-agent-resource-00, dated 5 June 2026. Its status is Informational, and the page says it is not endorsed by the IETF. It defines one new resource, Agent, served at /Agents. It is a proposal, not a standard, and details can still change.

Why agents need an identity record

SCIM already tells apps which people exist and whether they are active. Agents are a gap. WorkOS, in its write-up of an earlier draft, describes the problem this way: automation that acts on its own has no consistent, standard way to be represented or governed, and each vendor handles "agents" differently. That makes provisioning and auditing harder than it needs to be.

The idea behind the drafts is to reuse what SCIM already does well. Same protocol, same style of schema, new resource type.

How the drafts got here

There was more than one starting point, and two companies were involved. In August 2025, Mark Wahl of Microsoft published draft-wahl-scim-agent-schema-01, "Agentic Identity Schema". It defined a resource called AgenticIdentity and already included an attribute that linked the record to OAuth. On 16 October 2025, Macy Abbey and Rafael S. Cohen of Okta published draft-abbey-scim-agent-extension-00, "SCIM Agents and Agentic Applications Extension", with two resource types: Agent at /Agents and AgenticApplication at /AgenticApplications. WorkOS covered the Okta draft on 30 October 2025. By its description there was also a fallback where a system without support could provision an agent as a normal User with a linked-object extension. Both of these earlier drafts have since expired. Our draft tracker compares all four drafts side by side.

The June 2026 draft is different in scope. AI Agent Resource Extension for SCIM lists four authors: Mark Wahl and Pamela Dingle from Microsoft, Danny Zollner from Okta, and Ismael Kazzouzi from Nextident. In revision 00 it defines the Agent resource only. I did not find AgenticApplication on that page. If you are comparing sources, check which draft each one is talking about. The two are easy to confuse.

A month later, on 26 July 2026, Saurabh Kushwaha of Oracle published draft-kushwaha-scim-agent-governance-00, an optional extension for the Agent resource. It adds a lifecycle state (established, active, suspended, quarantined, archived), an autonomy level, a validity window (validFrom and validTo) and a credentialDiscoveryUri. It is also an individual draft with no formal standing.

The timeline on the home page shows the main steps.

What the Agent resource contains

The schema URN is urn:ietf:params:scim:schemas:core:2.0:Agent. These are the attributes in the core schema of draft revision 00:

Attribute	Required	What it is
`active`	Yes	Administrative status. False means the service should treat the identity as inactive. The service decides the final meaning.
`displayName`	Yes	Human-readable name.
`agentUserName`	Yes	Identifier that is unique across Agent resources in the provisioning domain.
`description`	No	Human-readable description.
`owners`	No	The responsible parties. Each entry has a `value`, and can carry `$ref` and `displayName`.

The draft also extends the group members attribute from RFC 7643 so that an Agent can be a member of a group. That is how you would give an agent the same role assignments you give a team.

What a record might look like

This is an illustration built from the attribute names above. It is not copied from the draft, and the owner value is a placeholder.

POST /scim/v2/Agents { "schemas": ["urn:ietf:params:scim:schemas:core:2.0:Agent"], "displayName": "Helpdesk bot", "agentUserName": "helpdesk-bot", "description": "Answers internal IT questions", "owners": [{ "value": "OWNER-USER-ID" }], "active": true }

The example on our home page is simpler on purpose. It uses name and owner and says so in a note under the code. The real field names are the ones in the table.

What the draft does not say

This is the part people skip. The draft gives agents a record, an owner list and an on/off switch. It does not describe what should happen to an agent's access, its owners or its group memberships once active becomes false. It does not say what happens to an agent when its owner leaves the company. Credentials are not part of the attributes I found either, although the earlier draft, as WorkOS describes it, had a certificate attribute.

The Oracle governance draft tries to fill part of this gap with richer lifecycle states than on and off. Until something is adopted, all of that is policy you will have to write yourself, whatever the standard ends up looking like. The offboarding checklist and the inventory guide on this site cover the practical side.

What to do right now

Do not build to revision 00 as if it were final. The draft shows an expiry date of 7 December 2026, so a new revision is likely.
Check the datatracker page and our draft tracker for newer revisions before you design anything around field names. Each field has its own entry in the glossary.
Start the work that does not depend on the standard: know which agents you run, who owns each one, and how you would switch each off.

SCIM itself is not new. The protocol has been a Standards Track RFC since 2015. Only the agent extension is still moving.

Sources

Own the name for this category.

agentscim.com is for sale. If you build identity, security or agent tooling, write to me. Serious offers get a reply within 24 hours.

Make an offer

Keep reading

This is an independent page. It is not affiliated with the IETF, Okta or Microsoft. Standards and drafts change, so check the linked sources for the current state.