Home / Draft tracker

SCIM for AI agents: draft tracker

Last checked 18 October 2026

Four IETF Internet-Drafts propose how SCIM should describe AI agents. This page lists them in order, compares what each one defines, and links to the primary text.

Where things stand

None of these is a standard. All four are individual Internet-Drafts with no formal standing. Two have expired. The joint draft from Microsoft, Okta and Nextident (5 June 2026) is the base, and Oracle's governance draft (26 July 2026) extends it. SCIM itself is standardized in RFC 7643 and RFC 7644.

The drafts

Draft	Organization	Date	Expiry	Intended status
draft-wahl-scim-agent-schema-01	Microsoft	Aug 2025	Expired 20 Feb 2026	Informational
draft-abbey-scim-agent-extension-00	Okta	16 Oct 2025	Expired 19 Apr 2026	Standards Track
draft-wzdk-scim-agent-resource-00	Microsoft, Okta, Nextident	5 Jun 2026	Expires 7 Dec 2026	Informational
draft-kushwaha-scim-agent-governance-00	Oracle	26 Jul 2026	Expires 27 Jan 2027	Informational

What each one defines

Topic	Wahl (Aug 2025)	Abbey and Cohen (Oct 2025)	Joint (Jun 2026)	Governance (Jul 2026)
Resource name	AgenticIdentity	Agent, AgenticApplication	Agent	Extends Agent
Required fields	None listed as required	name	active, displayName, agentUserName	lifecycleState (if used)
Owner	owners (user, group, other)	owners (User, Group)	owners (User, Group, Agent refs)	Not changed
On/off	active	active	active	lifecycleState with 5 states, active derived
Credentials	oAuthClientIdentifiers	x509Certificates, subject	None	credentialDiscoveryUri
Application link	agenticApplicationId	AgenticApplication resource, applications	None	None
Other	Group membership, roles, entitlements	agentType, protocols (A2A, OpenAPI, MCP-Server), parent	Agents can be group members	autonomyLevel, validFrom, validTo

Built from the draft texts. "None listed" means the attribute list in that revision has no required marker I could find. Check the full text before relying on it.

Read each draft

Expireddraft-wahl-scim-agent-schema-01Microsoft. August 2025. AgenticIdentity resource with OAuth client identifiers. Expired.Expireddraft-abbey-scim-agent-extension-00Okta. 16 October 2025. Agent plus AgenticApplication, with credentials and protocols. Expired.Active individual draftdraft-wzdk-scim-agent-resource-00Microsoft, Okta and Nextident. 5 June 2026. One resource (Agent), five attributes.Active individual draftdraft-kushwaha-scim-agent-governance-00Oracle. 26 July 2026. Lifecycle states, autonomy level, validity window, credential discovery.

How to read this

Expired means the six-month life of an Internet-Draft ran out without a new revision. The text stays archived and can be revived.
Informational and Standards Track are the intended status the authors chose. They are not a decision by the IETF.
The IETF says it is inappropriate to cite drafts as anything other than "work in progress".
Look up individual fields in the glossary. For the plain-English version, read SCIM for AI agents: what the IETF draft says so far.

Sources: the Internet-Draft texts and datatracker pages for each draft, and the WorkOS write-up of the Okta draft. This site is independent and not affiliated with the IETF, Okta, Microsoft, Oracle or Nextident. I read the texts on 18 October 2026. If a draft has changed since, the datatracker is the source of truth.

Own the name for this category.

agentscim.com is for sale. If you build identity, security or agent tooling, write to me. Serious offers get a reply within 24 hours.

Make an offer