draft-wahl-scim-agent-schema-01
The earliest of the agent drafts. It called the resource AgenticIdentity and already linked it to OAuth token exchange.
| Full title | System for Cross-domain Identity Management: Agentic Identity Schema |
|---|---|
| Author | Mark Wahl (Microsoft) |
| Revisions | 00 (initial), 01 (August 2025). The datatracker lists -01 as 2025-08-18, the document header says 19 August 2025. |
| Expired | 20 February 2026 |
| Intended status | Informational |
| Defines | The AgenticIdentity resource type |
| Datatracker | datatracker.ietf.org |
| Full text | draft-wahl-scim-agent-schema-01.txt |
What it defined
One new resource type, AgenticIdentity, representing an agent's identity to a service. It could include optional references to the identity's group memberships, roles and entitlements. The abstract says the goal is to establish an identity so that an agent can later be authenticated and authorized to interact with the service.
Attributes
Single-valued: active (if absent, the identity is assumed active), agenticApplicationId (an id assigned by the client, so a service can correlate several identities of one application), description and displayName.
Multi-valued: entitlements, groups, owners, roles and oAuthClientIdentifiers.
The OAuth link
The last attribute is the notable one. For agents that authenticate with OAuth token exchange, each value carries audiences, clientId, description, issuer, name and subject, tied to the JWT aud, iss and sub claims. It is one of the few places where a SCIM record and an OAuth identity are joined explicitly. The joint draft did not keep it. Our article on SCIM vs OAuth for AI agents explains why the connection matters.
Operations
The draft has sections for creating, retrieving and updating an agentic identity, for changing its group membership, and for deleting it. The deletion section only says a client can use the patterns in RFC 7644 section 3.6.
Revision history and status
The changelog says revision 01 only added a missing page header and table labels, with no protocol or data model changes. The draft expired on 20 February 2026 and is archived as an expired individual draft.
Facts on this page come from the text of the draft and its datatracker page, read on 18 October 2026. Drafts change, so check the datatracker for the current state. This site is independent and not affiliated with the IETF.
Own the name for this category.
agentscim.com is for sale. If you build identity, security or agent tooling, write to me. Serious offers get a reply within 24 hours.
Make an offer