owners
owners lists the responsible parties for an agent. It is optional and multi-valued.
| Defined in | draft-wzdk-scim-agent-resource-00 |
|---|---|
| Type | complex, multi-valued |
| Required | No |
| Sub-attributes | value (required), $ref (recommended), displayName (optional) |
What an owner can be
Each value references the id of a user, a group or another resource already known to the service. In the schema, the $ref sub-attribute accepts three reference types: User, Group and Agent. So an owner can be a person, a team, or another agent.
Sub-attributes
| Name | Requirement | Mutability |
|---|---|---|
value | Must be included. The id of the owner resource. | immutable |
$ref | Recommended. The URI of the owner resource. | readOnly |
displayName | Optional. The owner's display name. | readOnly |
Because value is immutable, changing an owner looks like removing one entry and adding another, not editing an entry in place. That is our reading of "immutable", not text from the draft.
Earlier drafts
The Okta draft said owners were User or Group objects. The Wahl draft let the owner reference a user, a group or another resource, and recommended the value sub-attribute. The joint draft makes it required.
What the draft does not say
Nothing in the text describes what happens to an agent when its owner is removed or deactivated. That is policy you have to write. Our offboarding checklist proposes a simple one: an agent with no active owner is flagged within a day.
Example
Taken from the example in the Oracle governance draft, which uses the joint draft's owners attribute.
Source: draft-wzdk-scim-agent-resource-00 (datatracker). Drafts change. Read on 18 October 2026. Independent site, not affiliated with the IETF.
Own the name for this category.
agentscim.com is for sale. If you build identity, security or agent tooling, write to me. Serious offers get a reply within 24 hours.
Make an offer