An enterprise identity provider brokers the token

The chain, step by step

1. 1

   Step 1: Alex → to Enterprise IdP (idp.corp.example)

   Alex signs in to the agent host with the company's single sign-on

   The host is an application the enterprise manages. The identity provider authenticates Alex and issues the host an ID token it keeps for later.

   4.2. User AuthenticationIdentity Assertion JWT Authorization Grant draft-04

2. 2

   Step 2: Enterprise IdP (idp.corp.example) → to Agent host

   ID token for the agent host

   4.2. User AuthenticationIdentity Assertion JWT Authorization Grant draft-04

   ID tokentyp JWT · alg RS256 · kid idp-2026

   iss

   https://idp.corp.example

   sub

   u-48213

   aud

   agent-host

   email

   alex@corp.example

   exp

   1790000000

   iat

   1789996400

   Unchanged since the previous token in this chain.

3. 3

   Step 3: Agent host → to Tasks MCP server

   Unauthenticated request, challenge, protected resource metadata and authorization server metadata, as in the baseline chain

   Discovery is unchanged: the host learns the server's resource identifier and that auth.tasks.example is its authorization server, and the server declares the enterprise-managed authorization extension.

   Implementation guide › For MCP serversMCP Enterprise-Managed Authorization stable

4. 4

   Step 4: Agent host → to Enterprise IdP (idp.corp.example)

   POST /token: grant_type=token-exchange, subject_token=<ID token>, subject_token_type=id_token, requested_token_type=id-jag, audience=https://auth.tasks.example, resource=https://mcp.tasks.example/mcp, scope=tasks:read

   Instead of sending Alex to the tasks server's authorization endpoint, the host asks the identity provider for a grant it can present there. The audience is the resource authorization server, not the MCP server.

   4.3. Token ExchangeIdentity Assertion JWT Authorization Grant draft-04

5. 5

   Step 5: Enterprise IdP (idp.corp.example) → to itself

   Evaluate policy: may this user, through this app, reach this server with this scope?

   Group membership, the approved-app list and conditional access are checked here, once, centrally. A user without access gets an error and the host never receives a grant.

   4.3.3. Processing RulesIdentity Assertion JWT Authorization Grant draft-04

6. 6

   Step 6: Enterprise IdP (idp.corp.example) → to Agent host

   issued_token_type=id-jag with the signed grant

   4.3.4. ResponseIdentity Assertion JWT Authorization Grant draft-04

   Identity Assertion JWT Authorization Granttyp oauth-id-jag+jwt · alg RS256 · kid idp-2026

   iss

   https://idp.corp.example

   sub

   u-48213

   audchanged

   https://auth.tasks.example

   client_idadded

   https://agent.example/client.json

   scopeadded

   tasks:read

   resourceadded

   https://mcp.tasks.example/mcp

   jtiadded

   3a9e

   expchanged

   1789996700

   iat

   1789996400

   emailremoved

   no longer in the token

   7 claims differ from the previous token in this chain. The required claims are iss, sub, aud, client_id, jti, exp and iat; scope and resource are optional and carry what the policy allowed.

7. 7

   Step 7: Agent host → to auth.tasks.examplereplaces "access-token-request"

   POST /token: grant_type=jwt-bearer, assertion=<an ID-JAG issued for https://auth.notes.example>

   The grant is genuine, signed by the trusted identity provider, unexpired, for the right user; only its audience is another server.

   3.1. ID-JAG ClaimsIdentity Assertion JWT Authorization Grant draft-04

   An ID-JAG for another authorization servertyp oauth-id-jag+jwt · alg RS256 · kid idp-2026

   iss

   https://idp.corp.example

   sub

   u-48213

   audchanged

   https://auth.notes.example

   client_id

   https://agent.example/client.json

   scopechanged

   notes:read

   jtichanged

   51c0

   exp

   1789996700

   iat

   1789996400

   resourceremoved

   no longer in the token

   4 claims differ from the previous token in this chain.

8. 8

   Step 8: auth.tasks.example → to itselfreplaces "validate-jag"

   Validate signature, iss, exp and jti; aud is not compared with this server's issuer

   With the audience unchecked, one grant from the identity provider opens every authorization server that trusts it.

   4.4.1. Processing RulesIdentity Assertion JWT Authorization Grant draft-04

9. 9

   Step 9: auth.tasks.example → to Agent host

   Access token for the tasks server, scope as granted

   4.4.2. ResponseIdentity Assertion JWT Authorization Grant draft-04

   Access token for the Tasks MCP servertyp at+jwt · alg ES256 · kid auth-2026-1

   isschanged

   https://auth.tasks.example

   subchanged

   alex

   audchanged

   https://mcp.tasks.example/mcp

   client_id

   https://agent.example/client.json

   scopechanged

   tasks:read

   expchanged

   1790000000

   iatchanged

   1789996800

   jtichanged

   d02f

   7 claims differ from the previous token in this chain.

10. 10

    Step 10: Agent host → to Tasks MCP server

    POST /mcp (tools/call) with Authorization: Bearer <access token>

    Authorization › Access Token UsageMCP Authorization 2026-07-28

    Access token as presentedtyp at+jwt · alg ES256 · kid auth-2026-1

    iss

    https://auth.tasks.example

    sub

    alex

    aud

    https://mcp.tasks.example/mcp

    client_id

    https://agent.example/client.json

    scope

    tasks:read

    exp

    1790000000

    iat

    1789996800

    jti

    d02f

    Unchanged since the previous token in this chain.

11. 11

    Step 11: Tasks MCP server → to itself

    Validate signature, iss, exp and that aud is this server; check scope

    Security Considerations › Token Audience Binding and ValidationMCP Authorization 2026-07-28