<html aria-label="message body"><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">Hi Dick and Ethan,<div><br></div><div>Thanks for the updated version. The scope is much more clear in this version.</div><div><br></div><div>In Security Considerations section 3.3 there is a prohibition with using the id_token as an access token. Yet in the kubeclt example that has been mentioned a few times in the email thread, the id_token IS used as an access token. This is driven partly from the existing behavior of stuffing attributes for ABAC and roles for RBAC into the id_token.</div><div><br></div><div>I also believe that there is a need for an identity token that is intended to cross trust-domain boundaries. I’m thinking it may make sense to define a mechanism that serves both the single RP (and its components) as well as the larger use case of crossing trust-domain boundaries. I’d expect that decentralized systems will need this capability (e.g. bluesky).</div><div><br><div><div>
<div>George Fletcher</div><div>Identity Standards Architect</div><div>Practical Identity LLC</div><div><br></div><br class="Apple-interchange-newline">
</div>
<div><br><blockquote type="cite"><div>On Oct 1, 2025, at 7:13 AM, Dick Hardt via Openid-specs-ab <openid-specs-ab@lists.openid.net> wrote:</div><br class="Apple-interchange-newline"><div><div dir="ltr"><div dir="ltr"><div dir="ltr">Attached is a revised submission in HTML taking into consideration the feedback from the recent call for adoption.<br><br>repo: <a href="https://github.com/dickhardt/openid-key-binding">https://github.com/dickhardt/openid-key-binding</a><br>online html: <a href="https://dickhardt.github.io/openid-key-binding/main.html">https://dickhardt.github.io/openid-key-binding/main.html</a><br><br>The authors would like to thank Jacob for his review and feedback.<div><br></div><div>/Dick & Ethan</div></div></div></div>
<span id="cid:f_mg7w0jdu0"><main.html></span>_______________________________________________<br>Openid-specs-ab mailing list<br>Openid-specs-ab@lists.openid.net<br>https://lists.openid.net/mailman/listinfo/openid-specs-ab<br></div></blockquote></div><br></div></div></body></html>