validFrom and validTo
validFrom and validTo bound the period in which an agent is meant to operate. Think of the notBefore and notAfter fields of a certificate.
| Defined in | draft-kushwaha-scim-agent-governance-00 |
|---|---|
| Type | dateTime (RFC 3339) |
| Required | No, both are optional |
| Evaluated | At each authentication or issuance decision |
Meaning
validFrom is the instant from which the agent may be activated. validTo is the instant after which its identity is no longer valid. The draft compares them to the notBefore and notAfter fields of an X.509 certificate.
What a service should do
An agent outside its window should be treated as if its state were suspended, whatever the stored value says, and the service should not issue new credentials or tokens for it. The stored lifecycleState.state does not change just because time passes. The window is checked every time.
Finding lapsed agents
Services should support filtering on both attributes. The draft shows a query for agents whose window has ended but whose state is still active, which means nobody has tidied up.
Why it is useful
A fixed end date turns "someone should clean this up" into something the system enforces. A pilot agent with a three-month window expires by itself. That is our reading of the benefit, not a claim from the draft. See the inventory guide for how to use it.
Example
Values from the draft's own example.
Source: draft-kushwaha-scim-agent-governance-00 (datatracker). Drafts change. Read on 18 October 2026. Independent site, not affiliated with the IETF.
Own the name for this category.
agentscim.com is for sale. If you build identity, security or agent tooling, write to me. Serious offers get a reply within 24 hours.
Make an offer