The clock is ticking on the foundational protocol for Agent SSO. As of October 17, 2026, exactly 36 days remain before the current revision of the ID-JAG draft expires on November 22, 2026. While draft expiration is a routine administrative milestone in the IETF lifecycle, this one highlights the widening chasm between commercial agent infrastructure that is shipping now and the institutional process that is supposed to anchor it.
ID-JAG, or the Identity Assertion JWT Authorization Grant, provides the mechanism for Cross-App Access (XAA). Authored by Aaron Parecki of Okta, Karl McGuinness, and Brian Campbell of Ping Identity, the draft extends OAuth 2.0 Token Exchange and the JWT Profile for Authorization Grants into a standardized way for an application to obtain access to another application’s API on behalf of a user, mediated by the identity provider both applications already trust for single sign-on. No user-approval step at the downstream authorization server. No static API keys. Short-lived, scoped, auditable tokens issued in real time. That is the pattern the agent economy needs at scale, and ID-JAG is the closest thing the IETF has produced to a specification for it.
The protocol remains in institutional limbo. The IESG status reads “I-D Exists.” No Working Group Last Call is scheduled. No telechat date. No responsible Area Director assigned. The OAuth Working Group adopted ID-JAG in September 2025; one year later, it sits at revision -04. Aaron Parecki, who chairs the OAuth WG, has said it will still be a while before the draft becomes an RFC. As this publication noted last week, the broader IETF landscape for agent identity is fragmented: the WIMSE Working Group excludes agent-specific terminology, the DAWN effort remains in early chartering, and the agentproto Working Group was formed at IETF 126 in Vienna with contested scope.
Commercial entities are not waiting. Okta has moved to commercialize ID-JAG through its Cross-App Access offering. Agent SSO reached general availability in August 2026, bringing XAA into Okta’s workforce plans for over 20,000 customers. The ecosystem now includes more than 25 partners, including Anthropic, Cloudflare, Keycloak, and WorkOS. The Model Context Protocol adopted XAA as its Enterprise-Managed Authorization extension, stable since June 2026. Descope shipped ID-JAG issuance and validation in its Agentic Identity Hub 3.0 on October 15. These vendors are building production identity infrastructure on a draft that has no formal path to finalization.
The draft can be refreshed with a new revision before it expires. Internet-Drafts lapse routinely and get replaced. But the absence of a WGLC timeline is the signal. Without a Working Group Last Call, there is no institutional commitment to move the protocol through the approval pipeline. The vendors anchoring their products to ID-JAG are operating in a pre-standard reality where commercial implementation defines the protocol’s shape, not the other way around. That works until it does not. If the IETF eventually mandates deviations that conflict with what Okta, Descope, and others have shipped, those vendors face a refactor. If the draft lapses without a successor, the formal anchor disappears and the risk of divergent, incompatible implementations rises.
For builders, the practical guidance is to anchor on the pattern rather than the draft revision number. XAA and Enterprise-Managed Authorization are proving their value in production environments across 25-plus integrations today. The pattern is sound. But any implementation should be designed with the assumption that the specification may change, and vendor lock-in to a single interpretation of an unfinished standard carries real risk.
For investors, the WGLC timeline is the leading indicator. A Working Group Last Call would signal that the IETF considers the protocol stable enough for final review and that the institutional machinery is engaged. Until that happens, the agent identity market operates on commercial momentum alone. With Gartner projecting that the average Fortune 500 enterprise will manage over 150,000 agents by 2028, and only 13 percent of organizations reporting confidence in their AI governance, the gap between what the market needs and what the standards body has delivered is not closing. It is the gap itself that is becoming the story.
