Driving Permits: Delegated, Short-Lived Authority for AI Agents Part 3
A signed task proves who wrote it, not who allowed it. RFC 8693 permits with sub, act, scope and a 120s TTL, checked by OPA at the MCP gateway.
A signed task proves who wrote it, not who allowed it. RFC 8693 permits with sub, act, scope and a 120s TTL, checked by OPA at the MCP gateway.
OAuth is authorization. OIDC is identity. MFA is necessary but not sufficient. A practitioner's map of AuthN, AuthZ, federation, and the DevOps use cases that live on top.