What happened
On 21 October 2026 the individual Internet-Draft was updated to revision -02 (last updated 2026-10-21, Standards Track). It defines a profile of OpenID Connect Core 1.0 enabling IdPs to issue identity tokens for autonomous agents, adding standard claims (agent_id, agent_owner, agent_trust_score/level, agent_capabilities, agent_sanctions_status, agent_spend_limit, etc.) and graduated access control based on agent trust levels and sanctions screening.
Why it matters
Directly relevant to agent identity security: it lets existing OIDC infrastructure carry machine-checkable agent identity, ownership, trust posture, and capability claims without protocol changes, supporting enforcement of least-privilege and sanctions screening for autonomous agents. The -02 revision refines claim definitions and validation flows.
Action needed
Review the new claims/profile if you operate OIDC infrastructure that will issue or consume agent identities; comment on the draft.