lifecycleState
lifecycleState is a complex attribute from the governance extension. It replaces a simple on/off flag with five states and strict rules for moving between them.
| Defined in | draft-kushwaha-scim-agent-governance-00 (July 2026) |
|---|---|
| Schema URN | urn:ietf:params:scim:schemas:extension:agent:2.0:Governance |
| Required | Yes, if the extension is present |
| Sub-attributes | state, reason, transitionedAt, transitionedBy |
The five states
| State | Meaning for agents |
|---|---|
established | Provisioned but not yet activated. The agent cannot authenticate. |
active | Fully operational. |
suspended | Temporarily disabled by an administrator. Reversible. Outstanding tokens should be revoked or suspended. |
quarantined | Frozen pending a security investigation. All access must be blocked, and the record and evidence must be preserved unchanged. |
archived | Terminal. Authority is permanently withdrawn. The record is kept for audit. |
Where the states come from
The values adopt the identity lifecycle of ISO/IEC 24760-1, without unknown, and add one agent-specific state, quarantined. The draft explains why: a compromised agent can keep acting at machine speed, and an investigation needs the record, credential references and relationships kept exactly as they were at detection time.
Transitions
The service must enforce a fixed graph and reject any other move with HTTP 400 and error type invalidValue.
- established to active.
- active to suspended, and back.
- active or suspended to quarantined.
- quarantined to suspended, or to active only after the investigation is closed and an authorized administrator approves it.
- Any non-terminal state to archived.
- archived to nothing. It is terminal.
Every permitted transition updates transitionedAt and transitionedBy, which the service assigns.
Why archived is final
ISO/IEC 24760-1 allows restoring identity information from the archived stage. The draft deliberately does not. Restoring an agent whose authority was withdrawn for cause could silently re-establish it. If the function is still needed, a new Agent resource should be created and the archived record kept intact. Whether the end was planned or for cause goes in the reason sub-attribute.
Defaults and filtering
On creation the state should default to established. Services should support filtering on lifecycleState.state, so an access review can list, for example, every quarantined agent.
Example
Adapted from figure 2 of the draft, on one line.
Source: draft-kushwaha-scim-agent-governance-00 (datatracker). Drafts change. Read on 18 October 2026. Independent site, not affiliated with the IETF.
Own the name for this category.
agentscim.com is for sale. If you build identity, security or agent tooling, write to me. Serious offers get a reply within 24 hours.
Make an offer