MCP Is Forming an Agent Identity Working Group Around DPoP and Token Exchange

Model Context Protocol·medium signalXBlueskyLinkedInCopy link

The roadmap concedes that MCP authorization assumes a person with a browser at consent time, while the caller is increasingly a cloud workload with its own identity acting for an absent user, or a sub-agent that should get narrower authority than its parent. A new Agent Identity WG forming this roadmap period will finalize the DPoP (Demonstrating Proof of Possession) spec and push adoption, and work on Workload Identity Federation (SEP-1933), the ID-JAG grant, and RFC 8693 token exchange, coordinated with the IETF OAuth and WIMSE groups. Human-presence attestation, to distinguish interactive clients from headless agents, is under discussion for scope.