⚠

Conceptual specification. This protocol is a pre-submission draft, not a finalized standard. The specification describes intended behavior and design intent. It has not been adopted by any IETF Working Group and is subject to change. Cred implements the delegation pipeline described here as a reference implementation, but full protocol conformance is a work in progress.

draft-sweeney-wimse-credential-delegation-00

Cred Protocol

open standard for credential delegation in multi-agent systems

MCP standardizes how agents connect to tools. A2A standardizes agent-to-agent communication. No open standard governs how credentials flow through these connections. The Cred Protocol fills this gap — a profile of existing OAuth 2.0 standards that defines secure, auditable credential delegation for AI agents.

github.com/cred-ninja/sdk →Complements draft-klrc-aiagent-auth-00

01 — System Architecture

Subject

Human User

credential owner

›Connects OAuth services to the portal (Google, GitHub, Slack, Notion, Salesforce)
›Sets delegation policies per agent operator
›Receives CIBA consent push when an agent requests new capabilities
›Approves or denies in-flight delegation requests
›Revokes any delegation subtree at any time — cascades in <5s

↓ OAuth tokens, consent decisions↑ CIBA push, consent requests

Delegation Server

Trust Anchor

credentials never cross this boundary

Credential Vault

AES-256-GCM encrypted OAuth tokens. Referenced by opaque credential_handle only. Decrypted in-process, never returned to callers. AWS KMS key management with per-account isolation.

Delegation Engine

Issues DPoP-bound DelegationTokens. Validates capability attenuation — authority can only narrow, never widen. Generates DS-signed prf receipts per hop to prevent RFC 8693 chain splicing.

Consent Manager

CIBA-derived backchannel consent — no redirect URI required. Immutable consent records retained minimum 90 days. Re-consent triggered on scope widening, expiry, or agent_operator change.

Exercise Proxy + Audit

Validates DT and DPoP proof, retrieves credential from Vault, calls resource server with stored token, returns API response only. Synchronous revocation: root <1s, full tree <5s. Tamper-evident audit log with consent_id chain tracing.

◈ Agent trust boundary — credentials never cross below this line ◈

↓ DelegationToken, API responses↑ JWT Bearer auth, /exercise requests

Agent

Autonomous Entity

never holds raw credentials

›Generates ephemeral Ed25519 keypair at instantiation, derives did:key — no pre-registration
›Authenticates to DS via JWT Bearer assertion (RFC 7523), signed with private key
›Requests delegation specifying authorization_details capability set
›Receives DelegationToken — DPoP-bound, capability-shaped, 15-min TTL
›Calls /exercise with DT + DPoP proof to use a credential — receives API response only

02 — Delegation Flow

Phase 1: Setup

Phase 2: Bootstrap

Phase 3: Delegation

Phase 4: Exercise

Phase 5: Revocation

sequenceDiagram
  participant S  as Subject
  participant DS as Delegation Server
  participant V  as Credential Vault
  participant A  as Agent
  participant RS as Resource Server

  Note over S,V: Phase 1 - Setup once per OAuth service
  S->>DS: Authorize Google OAuth
  DS->>S: Redirect to provider consent
  S->>DS: OAuth callback with auth code
  DS->>DS: Exchange code for refresh token
  DS->>V: Encrypt and store token AES-256-GCM
  DS-->>S: Connection confirmed

  Note over A,DS: Phase 2 - Agent identity bootstrap
  A->>A: Generate Ed25519 keypair
  A->>A: Derive did:key from public key
  A->>A: Sign JWT Bearer assertion exp 5 min

  Note over A,DS: Phase 3 - Delegation request
  A->>DS: POST /delegate JWT Bearer plus capabilities
  DS->>DS: Validate JWT Bearer and jti replay check
  DS->>S: CIBA backchannel consent push
  S-->>DS: Approve with scoped capabilities
  DS->>DS: Issue DelegationToken DPoP-bound 15 min TTL
  DS->>DS: Sign prf receipt for chain integrity
  DS-->>A: DelegationToken issued
  Note over A,A: Agent holds DT only - not the credential

  Note over A,RS: Phase 4 - Credential exercise
  A->>DS: POST /exercise with DT and DPoP proof
  DS->>DS: Validate DT signature and expiry
  DS->>DS: Verify DPoP binding to htm and htu
  DS->>DS: Check operation within authorization_details
  DS->>V: Retrieve credential by credential_handle
  V-->>DS: Decrypted token in-process only
  DS->>RS: API call with stored access token
  RS-->>DS: API response
  DS-->>A: API response only - credential not returned
  DS->>V: Wipe decrypted credential from memory

  Note over S,DS: Phase 5 - Revocation
  S->>DS: DELETE /delegation/jti
  DS->>DS: Invalidate root DT within 1 second
  DS->>DS: Cascade to child DTs within 5 seconds
  DS-->>A: HTTP 401 delegation_revoked on next request

03 — Delegation Token Anatomy

DelegationToken — DPoP-bound JWTmax TTL: 1 hour | recommended: 15 min

iss

Delegation Server URI

Identity of the issuing DS instance

sub

Subject identifier

Human user on whose behalf delegation occurs

act.sub

did:key:z6Mk...

Agent DID per RFC 8693 §4.1 actor claim

authorization_details

[ { type, provider, operations, resources, constraints } ]

RFC 9396 capability array — operation + resource + time bound + rate limit

cnf.jkt

DPoP public key thumbprint

RFC 9449 proof-of-possession — prevents token theft and replay

credential_handle

opaque string

Vault reference only — raw credential never appears in the token

consent_id

uuid

Traceable to root consent event in the immutable audit log

prf

[ receipt-CID, ... ]

DS-signed receipts per hop — prevents RFC 8693 chain splicing

exp / iat / jti

Unix timestamps + nonce

Expiry, issuance time, unique ID for replay prevention

04 — Core Design Properties

No credential possession

Agents receive DelegationTokens, not credentials. Raw OAuth tokens never cross the agent trust boundary. Prompt injection cannot exfiltrate what the agent does not hold.

Structural attenuation

Sub-delegation can only narrow capabilities — never widen. Enforced by the DS at issuance time, not by trusting agents. Authority flows downward and only shrinks.

Capability-shaped tokens

Not "access Google Drive" but drive.files.get on folder:abc123 with max_calls: 10 until time T. Eliminates ambient authority — the confused deputy exploit surface.

Synchronous revocation

Root DT invalidated in <1s. Full delegation tree cascade in <5s. Eventual consistency is not acceptable for adversarially-promptable systems.

Chain splicing prevention

Each hop produces a DS-signed prf receipt cross-referencing parent and child jti values. Closes the RFC 8693 §2.1-2.2 vulnerability disclosed to the OAuth WG, February 2026.

No pre-registration

Agents derive identity from an ephemeral Ed25519 keypair at instantiation via did:key. The DS accepts any DID it has not seen before. Zero admin provisioning required.

05 — Standard Composition

RFC 8693

OAuth 2.0 Token Exchange

Wire protocol. act and may_act provide delegation semantics. Production at MS Entra, Google, Auth0, Keycloak. Deliberately underspecified — Cred defines the delegation mechanics it leaves open.

RFC 9449

DPoP

Proof-of-possession per request. Bound to HTTP method and URI. Prevents DelegationToken theft and replay without requiring changes at resource servers.

RFC 9396

Rich Authorization Requests

Structured capability claims via authorization_details. Operation + resource + constraints. Not coarse OAuth scopes — resource- and operation-level granularity.

RFC 7523

JWT Bearer

Agent authentication to DS. Signed with ephemeral Ed25519 key. No client_secret required. Supports did:key as issuer. Five-minute maximum assertion lifetime.

OIDC CIBA

Backchannel Auth

Async consent without redirect URI. Agent-initiated flows pause awaiting Subject approval on mobile. The only consent flow that works for fully autonomous agents.

W3C did:key

Ephemeral Agent Identity

DID derived deterministically from Ed25519 public key. Self-certifying, no CA, no admin provisioning. New keypair per session. DS must accept any DID it has not seen before.

06 — Status

✓Research synthesisMarch 2026

✓Pre-submission draft (draft-sweeney-wimse-credential-delegation-00)March 2026

○IETF 125 remote attendance (Shenzhen)March 14–20, 2026

○NIST comment submission (AI-Identity@nist.gov)Before April 2, 2026

○Full xml2rfc Internet-DraftMay 2026

○IETF 126 submission (Vienna)July 2026

Read the Specification

The full pre-submission draft is on GitHub. Issues, security analysis, and PRs welcome — particularly from implementers and IETF participants.

github.com/cred-ninja/sdk →

Cred Protocol

open standard for credential delegation in multi-agent systems

sequenceDiagram participant S as Subject participant DS as Delegation Server participant V as Credential Vault participant A as Agent participant RS as Resource Server Note over S,V: Phase 1 - Setup once per OAuth service S->>DS: Authorize Google OAuth DS->>S: Redirect to provider consent S->>DS: OAuth callback with auth code DS->>DS: Exchange code for refresh token DS->>V: Encrypt and store token AES-256-GCM DS-->>S: Connection confirmed Note over A,DS: Phase 2 - Agent identity bootstrap A->>A: Generate Ed25519 keypair A->>A: Derive did:key from public key A->>A: Sign JWT Bearer assertion exp 5 min Note over A,DS: Phase 3 - Delegation request A->>DS: POST /delegate JWT Bearer plus capabilities DS->>DS: Validate JWT Bearer and jti replay check DS->>S: CIBA backchannel consent push S-->>DS: Approve with scoped capabilities DS->>DS: Issue DelegationToken DPoP-bound 15 min TTL DS->>DS: Sign prf receipt for chain integrity DS-->>A: DelegationToken issued Note over A,A: Agent holds DT only - not the credential Note over A,RS: Phase 4 - Credential exercise A->>DS: POST /exercise with DT and DPoP proof DS->>DS: Validate DT signature and expiry DS->>DS: Verify DPoP binding to htm and htu DS->>DS: Check operation within authorization_details DS->>V: Retrieve credential by credential_handle V-->>DS: Decrypted token in-process only DS->>RS: API call with stored access token RS-->>DS: API response DS-->>A: API response only - credential not returned DS->>V: Wipe decrypted credential from memory Note over S,DS: Phase 5 - Revocation S->>DS: DELETE /delegation/jti DS->>DS: Invalidate root DT within 1 second DS->>DS: Cascade to child DTs within 5 seconds DS-->>A: HTTP 401 delegation_revoked on next request