OAuth Is Asking What Authorization Needs to Become

Heather explores the W3C Digital Credentials API and the challenge of defining shared responsibilities across browsers, operating systems, wallets, and credential protocols. Following discussions at TPAC, the working group has made progress toward an interoperable first version, while important questions about architectural boundaries and privacy remain unresolved. This episode examines selective disclosure, user consent, privacy fatigue, and the risks of relying on other components to protect users. Discover why too many permission prompts can undermine meaningful consent, and what coordinated protections are needed to make digital credentials trustworthy on the Web.

Heather examines SPICE, the IETF working group developing standards to make existing technologies more useful for digital credentials and presentations. From selective disclosure for CBOR Web Tokens to common claims and credential presentation architecture, the group is tackling practical interoperability challenges while building on established standards rather than reinventing the digital credential ecosystem. This episode explores what happens when standards work progresses smoothly, encounters fundamental design objections, or approaches completion. Discover how privacy, identifier design, interoperability testing, and working group lifecycles shape the future of digital credentials and standards development.

Learn why workload identity is becoming increasingly important as cloud infrastructure, distributed systems, and AI agents interact across organizational boundaries. The WIMSE working group at the IETF is developing ways to communicate workload identities and security contexts across environments, building on existing standards rather than creating an entirely new identity framework. This episode explores workload authentication, cryptographic proof, delegation, attestation, and discovery, while examining how AI agents complicate trust and authorization. Discover why proving what a workload is differs from deciding what it can do, and how standards work is addressing these emerging challenges.

Heather examines the growing landscape of AI standards at the W3C and IETF, exploring how different groups address content disclosure, AI content preferences, automated client authentication, agent capabilities, and identity. Although these efforts may appear to overlap, they often tackle distinct problems at different layers of web and Internet architecture. This episode explores why clear standards boundaries and coordination matter as AI systems become more interconnected. Heather considers the risks of incompatible assumptions between protocols and explains why interoperability, rather than one universal AI protocol, will be essential to building a coherent ecosystem.

Heather explores two emerging approaches to AI agent discovery: the W3C AI Agent Protocol Community Group and the proposed IETF Discovery of Agents with Names (DAWN) Working Group. She examines how their scopes differ, from broad agent architecture and capabilities to the narrower problem of finding an AI resource. This episode considers why discovery is more than search, and why boundaries matter. Heather examines what information discovery should reveal, how identity and trust fit into the architecture, and whether narrower standards may ultimately be easier to reuse and build upon.

Learn why OAuth is being pushed to reconsider what authorization needs to become as software grows more autonomous. Heather examines recent OAuth working group discussions around proof of possession, HTTP message signatures, threat models, and the architectural question of where software identity should live. The episode explores how agentic AI complicates delegated authorization, particularly when multiple software actors, permissions, and contexts are involved. Heather considers whether OAuth needs new extensions or whether some problems belong elsewhere, and why defining clear boundaries may matter more than creating another protocol.

Heather explores what it’s actually like to serve on the W3C Technical Architecture Group, from reviewing emerging web technologies to navigating architectural questions, consensus, and unfamiliar areas of the web platform. Rather than requiring expertise in every technology, TAG work depends on deep knowledge, curiosity, breadth, and the ability to ask useful questions. This episode examines how to build toward TAG service through W3C participation, standards work, and cross-domain thinking. Heather also discusses the real commitment involved, including workload, travel, employer support, funding, and the importance of maintaining independence while contributing to web architecture.

In this episode, Heather examines the gap between technical interoperability and real-world digital identity deployment. Wallets and verifiable credentials may successfully exchange information, but relying parties must navigate different wallets, browsers, operating systems, credential formats, trust models, and failure states. This episode explores why interoperability must include the full customer experience, not just protocol conformance. Heather considers the growing role of intermediaries, APIs, and verification platforms in absorbing complexity, while asking what happens to trust, privacy, correlation, and governance when another layer enters the identity transaction.

Discover how digital wallets and verifiable credentials are moving from pilots into real-world adoption, while revealing a critical gap: someone still has to accept the credential. Heather examines the verifier’s perspective, particularly as regulation accelerates digital identity adoption across Europe. This episode explores why compliance alone is not enough to create meaningful value. Heather considers how credentials could reduce manual review, fraud, data retention, and onboarding friction, while improving customer experience. The key question is simple: when a credential arrives, what old process goes away?

Discover how identity conferences can help practitioners stay current on digital identity, emerging standards, regulation, cybersecurity, and the challenges organizations are preparing to solve. Heather examines why choosing the right event matters when budgets, travel, and time are limited, and why there is no single best conference for everyone. This episode explores how to match conferences to your goals, whether you need enterprise identity insight, European policy perspectives, authentication expertise, or longer-term architectural thinking. Heather also considers what recordings miss: the informal conversations, unexpected connections, and human network that make conference attendance valuable.