- WG-UMA - mailman.kantarainitiative.org

Fwd: A decade-old standard just got agent-shaped
by Alec L 30 Aug '26

30 Aug '26

Hi all, wanted to share this post from Eve. It highlights recent UMA work in the AI authorization space by Nick G at Strata Identity. Direct link to the webiste: https://u4a.ai and repo: https://github.com/nickgamb/uma4agents There has been a lot of progress since this post a couple of months ago! If you're interested in discussing this work, let me know so we can schedule a meeting. Best, - Alec Alec Laws CTO Engineering | IDENTOS Inc. [image: mobilePhone] (647)-822-1529 [image: emailAddress] alec(a)identos.ca [image: twitter] <https://twitter.com/identos_inc> [image: linkedin] <https://www.linkedin.com/company/identos-inc/> ---------- Forwarded message --------- From: Eve Maler <eve(a)vennfactory.com> Date: Wed, Jul 15, 2026 at 5:01 PM Subject: A decade-old standard just got agent-shaped To: <alec(a)identos.ca> A working prototype answers the question every agent protocol dodges. ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ <https://vennfactory.us9.list-manage.com/track/click?u=e0aa8680af271a6c83ca2…> [image: LinkedIn icon] <https://vennfactory.us9.list-manage.com/track/click?u=e0aa8680af271a6c83ca2…> [image: Website icon] <https://vennfactory.us9.list-manage.com/track/click?u=e0aa8680af271a6c83ca2…> [image: Website icon] <https://vennfactory.us9.list-manage.com/track/click?u=e0aa8680af271a6c83ca2…> [image: YouTube icon] <https://vennfactory.us9.list-manage.com/track/click?u=e0aa8680af271a6c83ca2…> Hi superfriend, Almost exactly a year ago, I wrote about whether User-Managed Access (UMA) — the standard I founded and ran for years at Kantara — had anything to offer the AI agent moment. I called it Alice-to-Bob and Alice-to-Bot sharing, and left it as an open question. This week, thanks to Nick Gamb, it's not open anymore. *UMA for Agents* Every agent protocol available today answers one question: is this my agent, doing my task, accessing the right digital stuff of mine? None of them answer the harder one: is *your* agent allowed to touch *my* digital stuff? Most identity and security thinking about agents still models the solitary case — one person, their own agent, the digital footprint they already have — when the actual shape of an agent economy is Bob's agent showing up at Alice's door, asking for a resource that's hers. Alice's brokerage dashboard at Meridian Wealth — the actual resource Bob's agent is asking to touch. Source: uma4agents <https://vennfactory.us9.list-manage.com/track/click?u=e0aa8680af271a6c83ca2…> project. Nick and I have spent months trading ideas on how old standards tech holds up under agentic weight, and the proof-of-concept that answers it is his — built directly out of that back-and-forth. It carries UMA 2.0 into agent-shaped mechanics, paired with Dick Hardt's AAuth for agent identity and proof-of-possession. UMA was built for exactly this kind of asynchronous, policy-based consent — what I described last year (for those of you who remember O.G. web access management) as solving “WAM for people”: Alice gets access management controls of the sort only enterprises normally use, and Bob's agent is told how and where to ask for access instead of simply being denied. In the demo, Alice is a brokerage client and Bob is her financial advisor. His firm's agent asks for her holdings summary: granted automatically, purpose-bound and expiring, decided against terms Alice set in advance. Her transaction history: granted too, under stricter terms she dictated. Then the agent asks to place an actual trade — Alice's policy says *“ask me”* — so the request pends, her phone buzzes, and she approves that one trade, and only that trade, from her couch. Every connection, every promised term, every action taken lands in her activity ledger, and she can revoke any of it, any time. Every promise, every touch, every approval — tracked live in Alice's activity ledger. Source: uma4agents <https://vennfactory.us9.list-manage.com/track/click?u=e0aa8680af271a6c83ca2…> project. This is at the heart of the mutual agency problem I describe in Chapter 11 of *Mastering Digital Identity*. For the standards backstory — requesting parties, resource owners, why delegation matters here — my year-ago post “Whither User-Managed Access in the AI agent era?” <https://vennfactory.us9.list-manage.com/track/click?u=e0aa8680af271a6c83ca2…> has the details. To see it just work, check out Nick's repo <https://vennfactory.us9.list-manage.com/track/click?u=e0aa8680af271a6c83ca2…> . *A 17-year-old sketch, made real* The prototype does one more thing worth knowing about: it implements MyTerms (IEEE Std 7012-2025), the new standard for machine-readable consent terms, extended to cover the kinds of permissions agents actually request and the terms an owner like Alice is willing to grant. Applying MyTerms in this way descends directly from UMA's “Requesting Party Policy” concept, which I developed along with original UMAnitarians like Paul Bryan and Domenico Catalano. The UMA group was sketching resource-sharing contracts back in 2009. A 2009 mockup for fictional authorization service "CopMonkey"; the UMA group’s earliest sketch of a resource-sharing contract picker. Source: Kantara’s UMA Experience <https://vennfactory.us9.list-manage.com/track/click?u=e0aa8680af271a6c83ca2…> wiki page. Nick checked the prototype directly against the published 7012 standard: Alice's terms live at a stable, dereferenceable address, and both sides walk away holding the identical, signed record of exactly what was agreed. *Come find me* Here's the full roundup of stops in the next two months: - *July 16* — Book signing, North Texas ISSA Lunch 'n' Learn, Texas Star Country Club, Euless, TX. Register on EventBrite <https://vennfactory.us9.list-manage.com/track/click?u=e0aa8680af271a6c83ca2…> . - *July 21* — Talk, Q&A, and book signing, Silicon Valley ISSA, NetApp offices, San Jose, CA. I'm bringing 100 complimentary copies courtesy of Cyber1Armor. Register on Luma <https://vennfactory.us9.list-manage.com/track/click?u=e0aa8680af271a6c83ca2…> . - *August 3* — Talk and book signing at Ross Young's CISO Retreat, Las Vegas, NV. For CISOs and Deputy CISOs only. Register at CISO Tradecraft <https://vennfactory.us9.list-manage.com/track/click?u=e0aa8680af271a6c83ca2…> . - *August 14* — Speaking, Kwaai.ai <https://vennfactory.us9.list-manage.com/track/click?u=e0aa8680af271a6c83ca2…> virtual Friday public meeting. Details here <https://vennfactory.us9.list-manage.com/track/click?u=e0aa8680af271a6c83ca2…> . - *September 1* — Panel and book signing, The Deepfake Summit, Washington, DC. Convened by The Prism Project and Acuity Market Intelligence. Event details <https://vennfactory.us9.list-manage.com/track/click?u=e0aa8680af271a6c83ca2…> . *Need identity strategy advice?* If your organization is working through the tough questions of agent access control — or any other identity strategy question — reach out. I've got some advisory capacity available starting in October. Talk to Eve about advisory work <eve(a)vennfactory.com?subject=Advisory%20engagement&body=I'm%20interested%20in%20exploring%20your%20advisory%20services.%0A%0AOrganization%3A%20%0AKey%20advisory%20questions%3A%20%0ATimeframe%3A%20%0ABudget%3A%20%0AOther%20details%3A%20> All my best, Eve P.S. If you haven't picked up *Mastering Digital Identity* yet, find out where to buy it and get your free bonus chapter at the same time, at *masteringdigitalidentity.com* <https://vennfactory.us9.list-manage.com/track/click?u=e0aa8680af271a6c83ca2…> . *You’re receiving this email because you signed up to hear from me.* Update your preferences <https://vennfactory.us9.list-manage.com/profile?u=e0aa8680af271a6c83ca25927…> or unsubscribe <https://vennfactory.us9.list-manage.com/unsubscribe?u=e0aa8680af271a6c83ca2…> View in browser <https://mailchi.mp/vennfactory/julyb-uma4agents?e=816e8eca63>

2 1

Notice - Release of Work Group Participant Code of Conduct
by Amanda Gay 17 Jun '25

17 Jun '25

Dear WG Participants: This email is to inform you that the Work Group Participant Code of Conduct <https://kantara.atlassian.net/wiki/spaces/LC/pages/1055227915/Code+of+Condu…> has been passed by the Leadership Council and is in effect immediately – all group participation is now subject to the Code of Conduct. Reminder: Participation in Kantara Work Groups is subject to all Kantara policies <https://kantara.atlassian.net/wiki/spaces/GI/pages/1081775/All+Policies>. The Code of Conduct is now explicitly included in the Group Participation Agreement (GPA) for transparency as part of the applicable policies for Work Group participation. We request that Work Group participants complete a new GPA <https://kantarainitiative.org/gpa-signup/> at your earliest convenience. **Please note that if you do not complete a new GPA, you are still bound by the Code of Conduct. Thank you for your continued interest and participation in Kantara Initiative Work Groups! Please reach out to your WG Chairs or the Leadership Council with any questions or concerns. Best, -Amanda -- Amanda Gay | Work Groups and Membership [image: Logo, company name Description automatically generated] Phone: +1 571-475-8895 LinkedIn: @KantaraInitiative

1 0

UMA-based Pensions Dashboard Programme final standards approved and being used
by Eve Maler 20 Mar '25

20 Mar '25

I’m subscribed to the UK Pensions Dashboard Programme emails, and saw a notice today that all of its related standards, including the “technical standards” (among which are its UMA profiles), were approved for use as of March 13th. <https://www.pensionsdashboardsprogramme.org.uk/standards/technical-standards> pensionsdashboardsprogramme.org.uk<https://www.pensionsdashboardsprogramme.org.uk/standards/technical-standards> [X]<https://www.pensionsdashboardsprogramme.org.uk/standards/technical-standards> They also announced on March 5th that three ecosystem participants have successfully connected. <https://parliamentlive.tv/event/index/6c8b9018-cc69-4510-960d-ce001147cb0f> [share.jpg] Parliamentlive.tv<https://parliamentlive.tv/event/index/6c8b9018-cc69-4510-960d-ce001147cb0f> parliamentlive.tv<https://parliamentlive.tv/event/index/6c8b9018-cc69-4510-960d-ce001147cb0f> Pretty cool! [VF Logo Light Green Mix (on Dark BG) for email sig.png] Eve Maler, president and founder Cell and Signal +1 (425) 345-6756<tel:+1-425-345-6756>

3 2

Security Notification: Pass the permission ticket vulnerability
by Alec L 19 Mar '25

19 Mar '25

Hi, This is a notice of an identified vulnerability in the UMA 2 specification. Please refer to the attached documents for full details, including recommended next steps for mitigation if your implementation is affected. Many thanks to Gabriel Corona for his efforts in finding, documenting and explaining these issues to us! Please reach out if you'd like to discuss further, Best, - Alec *Am I impacted?* You are probably not impacted if UMA clients only interact with known resource and authorization services. You might be impacted if the following are true: * the UMA client is able to start flows with any UMA resource server * the UMA client is able to start flows with any UMA authorization server * the authorization server supports open dynamic registration of clients, without any pre-registration process or requirements for the client. In this case, you probably can't be sure that the client isn't a malicious AS Alec Laws CTO Engineering | IDENTOS Inc. [image: mobilePhone] (647)-822-1529 [image: emailAddress] alec(a)identos.ca [image: twitter] <https://twitter.com/identos_inc> [image: linkedin] <https://www.linkedin.com/company/identos-inc/>

3 4

Meeting Series on Vulnerabilities: Nov 7, 21, & Dec 5
by Alec L 07 Nov '24

07 Nov '24

Hi all, A few of us met this week and had a productive discussion about the disclosed vulnerabilities previously shared with the list. We decided to hold a series of three meetings to develop and publish a document outlining conditions and mitigations for implementers. The calls will be held on our normal bridge and time slot, Thursdays @ 1PM ET, on the following dates: Nov 7, Nov 21, & Dec 5 https://zoom.us/j/99487814311?pwd=dTAvZi9uN0ZmeXJReWRrc1Zycm5KZz09 Please reach out if you have any questions, or need help adding the meeting series to your calendar Best, - Alec Alec Laws CTO Engineering | IDENTOS Inc. [image: mobilePhone] (647)-822-1529 [image: emailAddress] alec(a)identos.ca [image: twitter] <https://twitter.com/identos_inc> [image: linkedin] <https://www.linkedin.com/company/identos-inc/>

1 1

Disclosure of a vulnerability in UMA 2.0
by Gabriel Corona 16 Oct '24

16 Oct '24

Hi, While testing UMA 2.0, I found that the protocol was vulnerable to a vulnerability (which may not apply in some deployments). It might be interesting to start by discussing this topic off-list in order to let the implementers the opportunity to implement suitable mitigations before public disclosure. Please let me know if you would be interested. If you know the contact of any other implementers please let me know. Regards, Gabriel Corona

3 3

Agenda for UMA telecon 2024-01-11
by Alec L 11 Jan '24

11 Jan '24

https://kantara.atlassian.net/wiki/spaces/uma/pages/327581697/UMA+telecon+2… Date and Time - Every other Thursday @ 1:00ET/10:00am PT - Screenshare and dial-in: https://zoom.us/j/99487814311?pwd=dTAvZi9uN0ZmeXJReWRrc1Zycm5KZz09 - United States: +1 346 248 7799, Access Code: 994 8781 4311 - See UMA calendar for additional details: https://kantara.atlassian.net/wiki/spaces/uma/pages/4857518/Calendar <https://kantara.atlassian.net/wiki/spaces/uma/pages/4857518> Agenda - Approve minutes since UMA telecon 2023-07-13 <https://kantara.atlassian.net/wiki/spaces/uma/pages/227311617> - Charter Refresh and 2024 Plan Draft Charter 2024 <https://kantara.atlassian.net/wiki/spaces/uma/pages/300744705> - UK Pensions Dashboard Draft Pension Dashboard Use-Case Report <https://kantara.atlassian.net/wiki/spaces/uma/pages/135659525> - AOB Alec Laws CTO Engineering | IDENTOS +1 (647) 822-1529 <+1+(647)822-1529+color=> alec(a)identos.ca <https://identos.ca/> [image: twitter] <https://twitter.com/aleclaws> [image: linkedin] <https://www.linkedin.com/in/aleclaws/>

1 0

Agenda for UMA telecon 2023-12-14
by Alec L 14 Dec '23

14 Dec '23

https://kantara.atlassian.net/wiki/spaces/uma/pages/291340289/UMA+telecon+2… UMA telecon 2023-12-14Date and Time - Every other Thursday @ 1:00ET/10:00am PT - Screenshare and dial-in: https://zoom.us/j/99487814311?pwd=dTAvZi9uN0ZmeXJReWRrc1Zycm5KZz09 - United States: +1 346 248 7799, Access Code: 994 8781 4311 - See UMA calendar for additional details: https://kantara.atlassian.net/wiki/spaces/uma/pages/4857518/Calendar <https://kantara.atlassian.net/wiki/spaces/uma/pages/4857518> Agenda - Approve minutes since UMA telecon 2023-07-13 <https://kantara.atlassian.net/wiki/spaces/uma/pages/227311617> - Charter Refresh and 2024 Plan Draft Charter 2024 <https://kantara.atlassian.net/wiki/spaces/uma/pages/300744705> - Cancelling Dec 28th Meeting, next meeting Jan 11 - UK Pensions Dashboard Draft Pension Dashboard Use-Case Report <https://kantara.atlassian.net/wiki/spaces/uma/pages/135659525> - AOB Alec Laws CTO Engineering | IDENTOS +1 (647) 822-1529 <+1+(647)822-1529+color=> alec(a)identos.ca <https://identos.ca/> [image: twitter] <https://twitter.com/aleclaws> [image: linkedin] <https://www.linkedin.com/in/aleclaws/>

1 0

Cancelling Sep 7 WG Call
by Alec L 07 Sep '23

07 Sep '23

Hi all, will have to cancel today's call, apologize for the short notice Best, - Alec

1 0

Agenda for UMA telecon 2023-06-29
by Alec L 29 Jun '23

29 Jun '23

https://kantara.atlassian.net/wiki/spaces/uma/pages/220659713/UMA+telecon+2… UMA telecon 2023-06-29Date and Time - Every other Thursday @ 1:00ET/10:00am PT - Screenshare and dial-in: https://zoom.us/j/99487814311?pwd=dTAvZi9uN0ZmeXJReWRrc1Zycm5KZz09 - United States: +1 346 248 7799, Access Code: 994 8781 4311 - See UMA calendar for additional details: https://kantara.atlassian.net/wiki/spaces/uma/pages/4857518/Calendar <https://kantara.atlassian.net/wiki/spaces/uma/pages/4857518> Agenda - Approve minutes since UMA telecon 2023-01-12 <https://kantara.atlassian.net/wiki/spaces/uma/pages/134512641> - Check-in, Pensions Dashboard Use-case report - How could we use funding from Kantara? - AOB

1 0