Agent-to-Agent (A2A) Profile for OAuth Transaction Tokens#

Chunchi Peter Liu, Yuan Ni

• Why: Agent-to-agent call chains are exposed to goal hijack, context poisoning, and privilege abuse (per OWASP's agentic-AI top 10). Transaction Tokens (draft-ietf-oauth-transaction-tokens, at -08) already propagate user/workload identity and authorization context across service chains; this profiles them for the agent case.
• What: Extends Transaction Tokens from service-to-service to agent-to-agent, embedding A2A call-chain context — user and agent identity, authorization context, and A2A message structure (task_id, context_id, message_id, role, metadata) — as claims so identity and intent survive across distributed agent workloads.
• How: Uses the Tx Token claim set: scope(purp) as immutable transaction purpose, tctx for immutable chain details, rctx for changeable environmental context; A2A message fields map into these. Open design questions flagged for the WG: whether scope derives from the A2A task_id or the external access token, and whether a new claim carries A2A context or rctx is reused. A merger with draft-oauth-transaction-tokens-for-agents is under discussion.
• Where applicable: Trusted-domain multi-agent workflows. Early individual draft (-00/-02) — but Transaction Tokens themselves are mature, and this is one of the two live profiles competing to be the A2A identity mechanism; watch the consolidation.