Hi all, wanted to share this post from Eve. It highlights recent UMA work in the AI authorization space by Nick G at Strata Identity. Direct link to the webiste: https://u4a.ai and repo: https://github.com/nickgamb/uma4agents There has been a lot of progress since this post a couple of months ago! If you're interested in discussing this work, let me know so we can schedule a meeting. Best, - Alec Alec Laws CTO Engineering | IDENTOS Inc. [image: mobilePhone] (647)-822-1529 [image: emailAddress] alec@identos.ca [image: twitter] <https://twitter.com/identos_inc> [image: linkedin] <https://www.linkedin.com/company/identos-inc/> ---------- Forwarded message --------- From: Eve Maler <eve@vennfactory.com> Date: Wed, Jul 15, 2026 at 5:01 PM Subject: A decade-old standard just got agent-shaped To: <alec@identos.ca> A working prototype answers the question every agent protocol dodges. ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ <https://vennfactory.us9.list-manage.com/track/click?u=e0aa8680af271a6c83ca25927&id=1c4cfc32a4&e=816e8eca63> [image: LinkedIn icon] <https://vennfactory.us9.list-manage.com/track/click?u=e0aa8680af271a6c83ca25927&id=481fb6e8a8&e=816e8eca63> [image: Website icon] <https://vennfactory.us9.list-manage.com/track/click?u=e0aa8680af271a6c83ca25927&id=7cafccc4b2&e=816e8eca63> [image: Website icon] <https://vennfactory.us9.list-manage.com/track/click?u=e0aa8680af271a6c83ca25927&id=efc768898c&e=816e8eca63> [image: YouTube icon] <https://vennfactory.us9.list-manage.com/track/click?u=e0aa8680af271a6c83ca25927&id=bf0d9d4110&e=816e8eca63> Hi superfriend, Almost exactly a year ago, I wrote about whether User-Managed Access (UMA) — the standard I founded and ran for years at Kantara — had anything to offer the AI agent moment. I called it Alice-to-Bob and Alice-to-Bot sharing, and left it as an open question. This week, thanks to Nick Gamb, it's not open anymore. *UMA for Agents* Every agent protocol available today answers one question: is this my agent, doing my task, accessing the right digital stuff of mine? None of them answer the harder one: is *your* agent allowed to touch *my* digital stuff? Most identity and security thinking about agents still models the solitary case — one person, their own agent, the digital footprint they already have — when the actual shape of an agent economy is Bob's agent showing up at Alice's door, asking for a resource that's hers. Alice's brokerage dashboard at Meridian Wealth — the actual resource Bob's agent is asking to touch. Source: uma4agents <https://vennfactory.us9.list-manage.com/track/click?u=e0aa8680af271a6c83ca25927&id=964875b7fd&e=816e8eca63> project. Nick and I have spent months trading ideas on how old standards tech holds up under agentic weight, and the proof-of-concept that answers it is his — built directly out of that back-and-forth. It carries UMA 2.0 into agent-shaped mechanics, paired with Dick Hardt's AAuth for agent identity and proof-of-possession. UMA was built for exactly this kind of asynchronous, policy-based consent — what I described last year (for those of you who remember O.G. web access management) as solving “WAM for people”: Alice gets access management controls of the sort only enterprises normally use, and Bob's agent is told how and where to ask for access instead of simply being denied. In the demo, Alice is a brokerage client and Bob is her financial advisor. His firm's agent asks for her holdings summary: granted automatically, purpose-bound and expiring, decided against terms Alice set in advance. Her transaction history: granted too, under stricter terms she dictated. Then the agent asks to place an actual trade — Alice's policy says *“ask me”* — so the request pends, her phone buzzes, and she approves that one trade, and only that trade, from her couch. Every connection, every promised term, every action taken lands in her activity ledger, and she can revoke any of it, any time. Every promise, every touch, every approval — tracked live in Alice's activity ledger. Source: uma4agents <https://vennfactory.us9.list-manage.com/track/click?u=e0aa8680af271a6c83ca25927&id=5015cb98e2&e=816e8eca63> project. This is at the heart of the mutual agency problem I describe in Chapter 11 of *Mastering Digital Identity*. For the standards backstory — requesting parties, resource owners, why delegation matters here — my year-ago post “Whither User-Managed Access in the AI agent era?” <https://vennfactory.us9.list-manage.com/track/click?u=e0aa8680af271a6c83ca25927&id=316272381e&e=816e8eca63> has the details. To see it just work, check out Nick's repo <https://vennfactory.us9.list-manage.com/track/click?u=e0aa8680af271a6c83ca25927&id=6cad2a4052&e=816e8eca63> . *A 17-year-old sketch, made real* The prototype does one more thing worth knowing about: it implements MyTerms (IEEE Std 7012-2025), the new standard for machine-readable consent terms, extended to cover the kinds of permissions agents actually request and the terms an owner like Alice is willing to grant. Applying MyTerms in this way descends directly from UMA's “Requesting Party Policy” concept, which I developed along with original UMAnitarians like Paul Bryan and Domenico Catalano. The UMA group was sketching resource-sharing contracts back in 2009. A 2009 mockup for fictional authorization service "CopMonkey"; the UMA group’s earliest sketch of a resource-sharing contract picker. Source: Kantara’s UMA Experience <https://vennfactory.us9.list-manage.com/track/click?u=e0aa8680af271a6c83ca25927&id=399b439a01&e=816e8eca63> wiki page. Nick checked the prototype directly against the published 7012 standard: Alice's terms live at a stable, dereferenceable address, and both sides walk away holding the identical, signed record of exactly what was agreed. *Come find me* Here's the full roundup of stops in the next two months: - *July 16* — Book signing, North Texas ISSA Lunch 'n' Learn, Texas Star Country Club, Euless, TX. Register on EventBrite <https://vennfactory.us9.list-manage.com/track/click?u=e0aa8680af271a6c83ca25927&id=c8b364deab&e=816e8eca63> . - *July 21* — Talk, Q&A, and book signing, Silicon Valley ISSA, NetApp offices, San Jose, CA. I'm bringing 100 complimentary copies courtesy of Cyber1Armor. Register on Luma <https://vennfactory.us9.list-manage.com/track/click?u=e0aa8680af271a6c83ca25927&id=c957897f29&e=816e8eca63> . - *August 3* — Talk and book signing at Ross Young's CISO Retreat, Las Vegas, NV. For CISOs and Deputy CISOs only. Register at CISO Tradecraft <https://vennfactory.us9.list-manage.com/track/click?u=e0aa8680af271a6c83ca25927&id=f2794c5ef7&e=816e8eca63> . - *August 14* — Speaking, Kwaai.ai <https://vennfactory.us9.list-manage.com/track/click?u=e0aa8680af271a6c83ca25927&id=da9c86e73a&e=816e8eca63> virtual Friday public meeting. Details here <https://vennfactory.us9.list-manage.com/track/click?u=e0aa8680af271a6c83ca25927&id=205336aacc&e=816e8eca63> . - *September 1* — Panel and book signing, The Deepfake Summit, Washington, DC. Convened by The Prism Project and Acuity Market Intelligence. Event details <https://vennfactory.us9.list-manage.com/track/click?u=e0aa8680af271a6c83ca25927&id=9f33d2576f&e=816e8eca63> . *Need identity strategy advice?* If your organization is working through the tough questions of agent access control — or any other identity strategy question — reach out. I've got some advisory capacity available starting in October. Talk to Eve about advisory work <eve@vennfactory.com?subject=Advisory%20engagement&body=I'm%20interested%20in%20exploring%20your%20advisory%20services.%0A%0AOrganization%3A%20%0AKey%20advisory%20questions%3A%20%0ATimeframe%3A%20%0ABudget%3A%20%0AOther%20details%3A%20> All my best, Eve P.S. If you haven't picked up *Mastering Digital Identity* yet, find out where to buy it and get your free bonus chapter at the same time, at *masteringdigitalidentity.com* <https://vennfactory.us9.list-manage.com/track/click?u=e0aa8680af271a6c83ca25927&id=030a48eb05&e=816e8eca63> . *You’re receiving this email because you signed up to hear from me.* Update your preferences <https://vennfactory.us9.list-manage.com/profile?u=e0aa8680af271a6c83ca25927&id=77d135987f&e=816e8eca63&c=336bda348b> or unsubscribe <https://vennfactory.us9.list-manage.com/unsubscribe?u=e0aa8680af271a6c83ca25927&id=77d135987f&t=b&e=816e8eca63&c=336bda348b> View in browser <https://mailchi.mp/vennfactory/julyb-uma4agents?e=816e8eca63>
Hi all, nice to be in touch with you again, and thanks to Alec for forwarding the info! Right now this work is strictly about open-source prototyping, and we haven’t sketched actual UMA2 profiles or extensions. However, you can find, uh, “Findings<https://u4a.ai/docs/reference/findings/>” on the site. There’s also an overview<https://u4a.ai/docs/overview/compare-uma/> of what needed to change in the 2026 agent context, and a list of all the (many at this point) standards<https://u4a.ai/docs/overview/standards/> and other tech sources that have been incorporated — including Kwaai Personal AI and an extension of MyTerms. You can try out the lab directly in your browser by hitting the big green dropdown button at the upper right. We’ve been pulled into a number of interesting discussions since launching this investigation, with the concept of scalable “decentralized authorization” of agents an attractor. I’ll be keeping alert to any interest in capturing profile or extension specs that help bring this vision to fruition. If it turns out any of y’all are interested, that would be great to know. Best, Eve [Logo (6) small.jpg] President & Founder, Venn Factory Digital Identity Strategist Author & Speaker Board Member Cell and Signal: +1 (425) 345-6756<tel:+14253456756> Eve’s new book, Mastering Digital Identity, is available now<https://masteringdigitalidentity.com> On Aug 27, 2026, at 12:13 PM, Alec L via WG-UMA <wg-uma@kantarainitiative.org> wrote: Hi all, wanted to share this post from Eve. It highlights recent UMA work in the AI authorization space by Nick G at Strata Identity. Direct link to the webiste: https://u4a.ai<https://urldefense.proofpoint.com/v2/url?u=https-3A__u4a.ai_&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=5sBoSfxIiqLtQortm8AmD_Id3ey-NnrSxMQ86O4reUc&m=8ofvhivJ2E9_wN4vAbhWfhKnk6T-G_lBfYK70iQFG_reFkl2fpdxY3gFJUkAxatx&s=aoY1qnCkEMjCG0H0vWwpUwWZQ7rvZOLqLn9Tw8MjDz8&e=> and repo: https://github.com/nickgamb/uma4agents<https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_nickgamb_uma4agents&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=5sBoSfxIiqLtQortm8AmD_Id3ey-NnrSxMQ86O4reUc&m=8ofvhivJ2E9_wN4vAbhWfhKnk6T-G_lBfYK70iQFG_reFkl2fpdxY3gFJUkAxatx&s=H6dA7g1c68Tqa5FolOq49Z29-41QU64yTYrOa5hIxNQ&e=> There has been a lot of progress since this post a couple of months ago! If you're interested in discussing this work, let me know so we can schedule a meeting. Best, - Alec Alec Laws CTO Engineering | IDENTOS Inc. [mobilePhone] (647)-822-1529<tel:(647)-822-1529> [emailAddress] alec@identos.ca<mailto:alec@identos.ca> [https://uploads-ssl.webflow.com/650c9dbaffb52efc03fda0ca/656f37e5c28b666130f...] [twitter]<https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_identos-5Finc&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=5sBoSfxIiqLtQortm8AmD_Id3ey-NnrSxMQ86O4reUc&m=8ofvhivJ2E9_wN4vAbhWfhKnk6T-G_lBfYK70iQFG_reFkl2fpdxY3gFJUkAxatx&s=Ystdc2Oraig6t8hXkcgZeIzXyUimead1b0PrSg_Alo8&e=> [linkedin]<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.linkedin.com_company_identos-2Dinc_&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=5sBoSfxIiqLtQortm8AmD_Id3ey-NnrSxMQ86O4reUc&m=8ofvhivJ2E9_wN4vAbhWfhKnk6T-G_lBfYK70iQFG_reFkl2fpdxY3gFJUkAxatx&s=ZGij2EMVoQj-wuHVqZBVecJMmHo4tHQJXPbs2U_icsA&e=> ---------- Forwarded message --------- From: Eve Maler <eve@vennfactory.com<mailto:eve@vennfactory.com>> Date: Wed, Jul 15, 2026 at 5:01 PM Subject: A decade-old standard just got agent-shaped To: <alec@identos.ca<mailto:alec@identos.ca>> A working prototype answers the question every agent protocol dodges. ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ <https://urldefense.proofpoint.com/v2/url?u=https-3A__vennfactory.us9.list-2Dmanage.com_track_click-3Fu-3De0aa8680af271a6c83ca25927-26id-3D1c4cfc32a4-26e-3D816e8eca63&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=5sBoSfxIiqLtQortm8AmD_Id3ey-NnrSxMQ86O4reUc&m=8ofvhivJ2E9_wN4vAbhWfhKnk6T-G_lBfYK70iQFG_reFkl2fpdxY3gFJUkAxatx&s=DzhUoZekALySd3Nf_-CLHtIAhFLfyy2c1dvLns6KXWE&e=> [https://brand-assets.mailchimp.com/01KHM28D4TQNQJQFAX6Q6R0NJ5.png] [LinkedIn icon]<https://urldefense.proofpoint.com/v2/url?u=https-3A__vennfactory.us9.list-2Dmanage.com_track_click-3Fu-3De0aa8680af271a6c83ca25927-26id-3D481fb6e8a8-26e-3D816e8eca63&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=5sBoSfxIiqLtQortm8AmD_Id3ey-NnrSxMQ86O4reUc&m=8ofvhivJ2E9_wN4vAbhWfhKnk6T-G_lBfYK70iQFG_reFkl2fpdxY3gFJUkAxatx&s=xHynJ9w6GHU3gmB6trARSMcuVqAVPl_T0eje9c-a1e8&e=> [Website icon]<https://urldefense.proofpoint.com/v2/url?u=https-3A__vennfactory.us9.list-2Dmanage.com_track_click-3Fu-3De0aa8680af271a6c83ca25927-26id-3D7cafccc4b2-26e-3D816e8eca63&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=5sBoSfxIiqLtQortm8AmD_Id3ey-NnrSxMQ86O4reUc&m=8ofvhivJ2E9_wN4vAbhWfhKnk6T-G_lBfYK70iQFG_reFkl2fpdxY3gFJUkAxatx&s=O-OTMPobkD6f3-_0X74Jo3WK9ko0dURuaxntW13ABaE&e=> [Website icon]<https://urldefense.proofpoint.com/v2/url?u=https-3A__vennfactory.us9.list-2Dmanage.com_track_click-3Fu-3De0aa8680af271a6c83ca25927-26id-3Defc768898c-26e-3D816e8eca63&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=5sBoSfxIiqLtQortm8AmD_Id3ey-NnrSxMQ86O4reUc&m=8ofvhivJ2E9_wN4vAbhWfhKnk6T-G_lBfYK70iQFG_reFkl2fpdxY3gFJUkAxatx&s=-gki_Jz1UvACtpqI_kwX_Yil0jjTfx0wbFzumhAbSPQ&e=> [YouTube icon]<https://urldefense.proofpoint.com/v2/url?u=https-3A__vennfactory.us9.list-2Dmanage.com_track_click-3Fu-3De0aa8680af271a6c83ca25927-26id-3Dbf0d9d4110-26e-3D816e8eca63&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=5sBoSfxIiqLtQortm8AmD_Id3ey-NnrSxMQ86O4reUc&m=8ofvhivJ2E9_wN4vAbhWfhKnk6T-G_lBfYK70iQFG_reFkl2fpdxY3gFJUkAxatx&s=dM97SX8UM3pXHbQRWCKGcPkF8sPyMdpHp01YfA-kAXo&e=> Hi superfriend, Almost exactly a year ago, I wrote about whether User-Managed Access (UMA) — the standard I founded and ran for years at Kantara — had anything to offer the AI agent moment. I called it Alice-to-Bob and Alice-to-Bot sharing, and left it as an open question. This week, thanks to Nick Gamb, it's not open anymore. UMA for Agents Every agent protocol available today answers one question: is this my agent, doing my task, accessing the right digital stuff of mine? None of them answer the harder one: is your agent allowed to touch my digital stuff? Most identity and security thinking about agents still models the solitary case — one person, their own agent, the digital footprint they already have — when the actual shape of an agent economy is Bob's agent showing up at Alice's door, asking for a resource that's hers. [https://mcusercontent.com/e0aa8680af271a6c83ca25927/images/dc73a9da-797c-7ac...] Alice's brokerage dashboard at Meridian Wealth — the actual resource Bob's agent is asking to touch. Source: uma4agents<https://urldefense.proofpoint.com/v2/url?u=https-3A__vennfactory.us9.list-2Dmanage.com_track_click-3Fu-3De0aa8680af271a6c83ca25927-26id-3D964875b7fd-26e-3D816e8eca63&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=5sBoSfxIiqLtQortm8AmD_Id3ey-NnrSxMQ86O4reUc&m=8ofvhivJ2E9_wN4vAbhWfhKnk6T-G_lBfYK70iQFG_reFkl2fpdxY3gFJUkAxatx&s=HLz3LOZ4jVWeFrrs4Pzij3mzh_J5y7lJR6AiLUGN86c&e=> project. Nick and I have spent months trading ideas on how old standards tech holds up under agentic weight, and the proof-of-concept that answers it is his — built directly out of that back-and-forth. It carries UMA 2.0 into agent-shaped mechanics, paired with Dick Hardt's AAuth for agent identity and proof-of-possession. UMA was built for exactly this kind of asynchronous, policy-based consent — what I described last year (for those of you who remember O.G. web access management) as solving “WAM for people”: Alice gets access management controls of the sort only enterprises normally use, and Bob's agent is told how and where to ask for access instead of simply being denied. In the demo, Alice is a brokerage client and Bob is her financial advisor. His firm's agent asks for her holdings summary: granted automatically, purpose-bound and expiring, decided against terms Alice set in advance. Her transaction history: granted too, under stricter terms she dictated. Then the agent asks to place an actual trade — Alice's policy says “ask me” — so the request pends, her phone buzzes, and she approves that one trade, and only that trade, from her couch. Every connection, every promised term, every action taken lands in her activity ledger, and she can revoke any of it, any time. [https://mcusercontent.com/e0aa8680af271a6c83ca25927/images/64cc44dd-26d2-648...] Every promise, every touch, every approval — tracked live in Alice's activity ledger. Source: uma4agents<https://urldefense.proofpoint.com/v2/url?u=https-3A__vennfactory.us9.list-2Dmanage.com_track_click-3Fu-3De0aa8680af271a6c83ca25927-26id-3D5015cb98e2-26e-3D816e8eca63&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=5sBoSfxIiqLtQortm8AmD_Id3ey-NnrSxMQ86O4reUc&m=8ofvhivJ2E9_wN4vAbhWfhKnk6T-G_lBfYK70iQFG_reFkl2fpdxY3gFJUkAxatx&s=JQCgzUnlHVCFSl_EkAwK5XBxBlQSnTNT1uVWx9cT5Lw&e=> project. This is at the heart of the mutual agency problem I describe in Chapter 11 of Mastering Digital Identity. For the standards backstory — requesting parties, resource owners, why delegation matters here — my year-ago post “Whither User-Managed Access in the AI agent era?”<https://urldefense.proofpoint.com/v2/url?u=https-3A__vennfactory.us9.list-2Dmanage.com_track_click-3Fu-3De0aa8680af271a6c83ca25927-26id-3D316272381e-26e-3D816e8eca63&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=5sBoSfxIiqLtQortm8AmD_Id3ey-NnrSxMQ86O4reUc&m=8ofvhivJ2E9_wN4vAbhWfhKnk6T-G_lBfYK70iQFG_reFkl2fpdxY3gFJUkAxatx&s=BAOhd5IEBPPoy6P27JvztHGArW3pynCdYqO-eQJc6ts&e=> has the details. To see it just work, check out Nick's repo<https://urldefense.proofpoint.com/v2/url?u=https-3A__vennfactory.us9.list-2Dmanage.com_track_click-3Fu-3De0aa8680af271a6c83ca25927-26id-3D6cad2a4052-26e-3D816e8eca63&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=5sBoSfxIiqLtQortm8AmD_Id3ey-NnrSxMQ86O4reUc&m=8ofvhivJ2E9_wN4vAbhWfhKnk6T-G_lBfYK70iQFG_reFkl2fpdxY3gFJUkAxatx&s=JkaUqv7gmHzW1IvSTb92RjMA89HoQU2rH6ASZsYMX6M&e=>. A 17-year-old sketch, made real The prototype does one more thing worth knowing about: it implements MyTerms (IEEE Std 7012-2025), the new standard for machine-readable consent terms, extended to cover the kinds of permissions agents actually request and the terms an owner like Alice is willing to grant. Applying MyTerms in this way descends directly from UMA's “Requesting Party Policy” concept, which I developed along with original UMAnitarians like Paul Bryan and Domenico Catalano. The UMA group was sketching resource-sharing contracts back in 2009. [https://mcusercontent.com/e0aa8680af271a6c83ca25927/images/f1936d2f-2496-4ae...] A 2009 mockup for fictional authorization service "CopMonkey"; the UMA group’s earliest sketch of a resource-sharing contract picker. Source: Kantara’s UMA Experience<https://urldefense.proofpoint.com/v2/url?u=https-3A__vennfactory.us9.list-2Dmanage.com_track_click-3Fu-3De0aa8680af271a6c83ca25927-26id-3D399b439a01-26e-3D816e8eca63&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=5sBoSfxIiqLtQortm8AmD_Id3ey-NnrSxMQ86O4reUc&m=8ofvhivJ2E9_wN4vAbhWfhKnk6T-G_lBfYK70iQFG_reFkl2fpdxY3gFJUkAxatx&s=O_M_Ax_eXp9tqEsrdAk5WBD0pYxaMZCQ6C21oQWik1A&e=> wiki page. Nick checked the prototype directly against the published 7012 standard: Alice's terms live at a stable, dereferenceable address, and both sides walk away holding the identical, signed record of exactly what was agreed. Come find me Here's the full roundup of stops in the next two months: * July 16 — Book signing, North Texas ISSA Lunch 'n' Learn, Texas Star Country Club, Euless, TX. Register on EventBrite<https://urldefense.proofpoint.com/v2/url?u=https-3A__vennfactory.us9.list-2Dmanage.com_track_click-3Fu-3De0aa8680af271a6c83ca25927-26id-3Dc8b364deab-26e-3D816e8eca63&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=5sBoSfxIiqLtQortm8AmD_Id3ey-NnrSxMQ86O4reUc&m=8ofvhivJ2E9_wN4vAbhWfhKnk6T-G_lBfYK70iQFG_reFkl2fpdxY3gFJUkAxatx&s=oInm74yFFNI8C9QKfd2ph8SVLAL06Dwgz4-oerJrkvg&e=>. * July 21 — Talk, Q&A, and book signing, Silicon Valley ISSA, NetApp offices, San Jose, CA. I'm bringing 100 complimentary copies courtesy of Cyber1Armor. Register on Luma<https://urldefense.proofpoint.com/v2/url?u=https-3A__vennfactory.us9.list-2Dmanage.com_track_click-3Fu-3De0aa8680af271a6c83ca25927-26id-3Dc957897f29-26e-3D816e8eca63&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=5sBoSfxIiqLtQortm8AmD_Id3ey-NnrSxMQ86O4reUc&m=8ofvhivJ2E9_wN4vAbhWfhKnk6T-G_lBfYK70iQFG_reFkl2fpdxY3gFJUkAxatx&s=u1PxIGikZB5mssXREiDOcpFt_G5uTpB8Zu5NuWpqG-4&e=>. * August 3 — Talk and book signing at Ross Young's CISO Retreat, Las Vegas, NV. For CISOs and Deputy CISOs only. Register at CISO Tradecraft<https://urldefense.proofpoint.com/v2/url?u=https-3A__vennfactory.us9.list-2Dmanage.com_track_click-3Fu-3De0aa8680af271a6c83ca25927-26id-3Df2794c5ef7-26e-3D816e8eca63&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=5sBoSfxIiqLtQortm8AmD_Id3ey-NnrSxMQ86O4reUc&m=8ofvhivJ2E9_wN4vAbhWfhKnk6T-G_lBfYK70iQFG_reFkl2fpdxY3gFJUkAxatx&s=j5Y7XsAsivTj0AZuL9o7wxZex8M_4ZyGT9_2Vd64XNA&e=>. * August 14 — Speaking, Kwaai.ai<https://urldefense.proofpoint.com/v2/url?u=https-3A__vennfactory.us9.list-2Dmanage.com_track_click-3Fu-3De0aa8680af271a6c83ca25927-26id-3Dda9c86e73a-26e-3D816e8eca63&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=5sBoSfxIiqLtQortm8AmD_Id3ey-NnrSxMQ86O4reUc&m=8ofvhivJ2E9_wN4vAbhWfhKnk6T-G_lBfYK70iQFG_reFkl2fpdxY3gFJUkAxatx&s=iHUyee3OoQhuGYYmXQP7_XrufnEZyi7UUm-WhJsHgag&e=> virtual Friday public meeting. Details here<https://urldefense.proofpoint.com/v2/url?u=https-3A__vennfactory.us9.list-2Dmanage.com_track_click-3Fu-3De0aa8680af271a6c83ca25927-26id-3D205336aacc-26e-3D816e8eca63&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=5sBoSfxIiqLtQortm8AmD_Id3ey-NnrSxMQ86O4reUc&m=8ofvhivJ2E9_wN4vAbhWfhKnk6T-G_lBfYK70iQFG_reFkl2fpdxY3gFJUkAxatx&s=CC8rAgrxcg3O23lwnG_MUFKkbfcv_YLlahNQhh129sI&e=>. * September 1 — Panel and book signing, The Deepfake Summit, Washington, DC. Convened by The Prism Project and Acuity Market Intelligence. Event details<https://urldefense.proofpoint.com/v2/url?u=https-3A__vennfactory.us9.list-2Dmanage.com_track_click-3Fu-3De0aa8680af271a6c83ca25927-26id-3D9f33d2576f-26e-3D816e8eca63&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=5sBoSfxIiqLtQortm8AmD_Id3ey-NnrSxMQ86O4reUc&m=8ofvhivJ2E9_wN4vAbhWfhKnk6T-G_lBfYK70iQFG_reFkl2fpdxY3gFJUkAxatx&s=Fk1GZ20n2cNIc7lzjSwpfpFPiij8CaGH38pOr-zL6NY&e=>. Need identity strategy advice? If your organization is working through the tough questions of agent access control — or any other identity strategy question — reach out. I've got some advisory capacity available starting in October. Talk to Eve about advisory work<mailto:eve@vennfactory.com?subject=Advisory%20engagement&body=I'm%20interested%20in%20exploring%20your%20advisory%20services.%0A%0AOrganization%3A%20%0AKey%20advisory%20questions%3A%20%0ATimeframe%3A%20%0ABudget%3A%20%0AOther%20details%3A%20> All my best, Eve P.S. If you haven't picked up Mastering Digital Identity yet, find out where to buy it and get your free bonus chapter at the same time, at masteringdigitalidentity.com<https://urldefense.proofpoint.com/v2/url?u=https-3A__vennfactory.us9.list-2Dmanage.com_track_click-3Fu-3De0aa8680af271a6c83ca25927-26id-3D030a48eb05-26e-3D816e8eca63&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=5sBoSfxIiqLtQortm8AmD_Id3ey-NnrSxMQ86O4reUc&m=8ofvhivJ2E9_wN4vAbhWfhKnk6T-G_lBfYK70iQFG_reFkl2fpdxY3gFJUkAxatx&s=-ZmpWwATzYLr4KEp-MNrhpvcouMlAXdU95a7VJghehU&e=>. You’re receiving this email because you signed up to hear from me. Update your preferences<https://urldefense.proofpoint.com/v2/url?u=https-3A__vennfactory.us9.list-2Dmanage.com_profile-3Fu-3De0aa8680af271a6c83ca25927-26id-3D77d135987f-26e-3D816e8eca63-26c-3D336bda348b&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=5sBoSfxIiqLtQortm8AmD_Id3ey-NnrSxMQ86O4reUc&m=8ofvhivJ2E9_wN4vAbhWfhKnk6T-G_lBfYK70iQFG_reFkl2fpdxY3gFJUkAxatx&s=3okVKgkKJaxR5nxn2eWqCYTxYwR5GMZsJpr7obGrHa0&e=> or unsubscribe<https://urldefense.proofpoint.com/v2/url?u=https-3A__vennfactory.us9.list-2Dmanage.com_unsubscribe-3Fu-3De0aa8680af271a6c83ca25927-26id-3D77d135987f-26t-3Db-26e-3D816e8eca63-26c-3D336bda348b&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=5sBoSfxIiqLtQortm8AmD_Id3ey-NnrSxMQ86O4reUc&m=8ofvhivJ2E9_wN4vAbhWfhKnk6T-G_lBfYK70iQFG_reFkl2fpdxY3gFJUkAxatx&s=Dg6TCUVVSMQBxFLMlqoiwSqMBzn9WSxluNfyGOiJM2o&e=> View in browser<https://urldefense.proofpoint.com/v2/url?u=https-3A__mailchi.mp_vennfactory_julyb-2Duma4agents-3Fe-3D816e8eca63&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=5sBoSfxIiqLtQortm8AmD_Id3ey-NnrSxMQ86O4reUc&m=8ofvhivJ2E9_wN4vAbhWfhKnk6T-G_lBfYK70iQFG_reFkl2fpdxY3gFJUkAxatx&s=hwGkbFW-Y8CEAhmD4kUtG98ehVXOV57sGHGbl71JIlQ&e=> _______________________________________________ A Community Group mailing list of https://urldefense.proofpoint.com/v2/url?u=http-3A__KantaraInitiative.org&d=DwICAg&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=5sBoSfxIiqLtQortm8AmD_Id3ey-NnrSxMQ86O4reUc&m=8ofvhivJ2E9_wN4vAbhWfhKnk6T-G_lBfYK70iQFG_reFkl2fpdxY3gFJUkAxatx&s=UOJf8sYKH_Ke5fWGA-vacXfRm8pYrbQzFENatfcYmUE&e= WG-UMA mailing list -- wg-uma@kantarainitiative.org To unsubscribe send an email to staff@kantarainitiative.org List archives -- https://urldefense.proofpoint.com/v2/url?u=https-3A__mailman.kantarainitiative.org_hyperkitty_list_wg-2Duma-40kantarainitiative.org_&d=DwICAg&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=5sBoSfxIiqLtQortm8AmD_Id3ey-NnrSxMQ86O4reUc&m=8ofvhivJ2E9_wN4vAbhWfhKnk6T-G_lBfYK70iQFG_reFkl2fpdxY3gFJUkAxatx&s=cK2FrwG5cPIBgk59yslkNORoUwl3Tevdf6_7r0UhvNA&e= ______ Group wiki -- https://urldefense.proofpoint.com/v2/url?u=https-3A__kantara.atlassian.net_wiki_spaces_WG-2DUMA&d=DwICAg&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=5sBoSfxIiqLtQortm8AmD_Id3ey-NnrSxMQ86O4reUc&m=8ofvhivJ2E9_wN4vAbhWfhKnk6T-G_lBfYK70iQFG_reFkl2fpdxY3gFJUkAxatx&s=-oeBh24b-EFnpmE1qSCCNn-moDwNFf8080Mab8hyprM&e=
participants (2)
-
Alec L -
Eve Maler