advancedPhase 9

Interaction Chaining (202 Bubbles Back)

R1 calls R2, but the downstream authorization needs the person's consent. Instead of blocking, R1 returns its own 202 to the original agent with an interaction URL that redirects through R1. The agent polls R1; R1 polls its downstream request in parallel. Once the person consents, R1 gets the auth token, completes the R2 call, and the agent's next poll returns the combined result.

§ Interaction Chaining

GET https://api.example/data202

The agent accesses R1 with its AS1-issued auth token (sig=jwt).

R1 needs data from R2, and the downstream authorization is going to need the person.

R1 bubbles the 202 back: its own pending URL plus an interaction URL pointing at R1.

A resource acting as an agent MUST return its own 202 with its own AAuth-Requirement and its own Location — it cannot hand the caller someone else's pending URL.

1 / 8

speed

Step 1: Agent → R1 with auth token → R1 bubbles 202

Request / response

Interaction Chain Timeline

→

GEThttps://api.example/data

Signature-KeyAAuth?

sig=jwt;jwt="eyJhbGciOiJFZERTQSIsImtpZCI6ImFzMS1rZXktMSIsInR5cCI6ImFhLWF1dGgrand…

Signature-InputAAuth?

sig=("@method" "@authority" "@path" "signature-key");created=1700000000;alg="ed2…

SignatureAAuth?

sig=:ZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGR…

HTTP Signaturescheme=jwt

Covered Components

@method

@authority

@path

signature-key

Signature Base

"@method": GET

"@authority": api.example

"@path": /data

"signature-key": sig=jwt;jwt="eyJhbGciOiJFZERTQSIsImtpZCI6ImFzMS1rZXktMSIsInR5cCI6ImFhLWF1dGgrand0In0…"

"@signature-params": sig=("@method" "@authority" "@path" "signature-key");created=1700000000;alg="ed25519"

Signature-Key Header

sig=jwt;jwt="eyJhbGciOiJFZERTQSIsImtpZCI6ImFzMS1rZXktMSIsInR5cCI6ImFhLWF1dGgrand0In0…"

Signature-Input Header

sig=("@method" "@authority" "@path" "signature-key");created=1700000000;alg="ed25519"

Auth Token (Agent→R1)aa-auth+jwt

Header

{"alg":"EdDSA",
"kid":"as1-key-1",
"typ"?Token type identifier. aa-agent+jwt = Agent Token, aa-person+jwt = Person Token, aa-resource+jwt = Resource Token, aa-auth+jwt = Auth Token:"aa-auth+jwt"
}

Payload

{"iss"?Issuer — who created and signed this token:"https://as.example",
"dwk"?Discovery Well-Known — the metadata document name for key discovery (e.g. aauth-agent.json, aauth-person.json):"aauth-access.json",
"aud"?Audience — which party should accept this token:"https://api.example",
"jti"?JWT ID — unique identifier for this token (replay detection, audit, revocation):"34449e73-d2d2-4e45-80d2-01b4b198e025",
"ps"?The person's Person Server. In a resource token, the iss of the person token the resource verified. In an auth token, the PS the person is represented by — and where an intermediary routes a downstream request.:"https://ps.example",
"sub"?Subject. In an agent token, the agent identifier. In a person, resource or auth token, the person's directed identifier — opaque, unique within the issuer. Identity is the pair (iss, sub); a sub from one issuer MUST NOT be matched against a record established under another.:"8f14e45fceea167a5a36dedd4bea2543",
"cnf"?Confirmation — proof-of-possession claim binding this token to a key:{"jwk"?JSON Web Key — the public key bound to this token:
},
"scope"?Authorized scope/permissions granted by this token:"read",
"iat"?Issued At — Unix timestamp when the token was created:1776222894,
"exp"?Expiration — Unix timestamp after which the token is invalid:1776226494
}

sig: jgOiLDIGo4TiSjiL9tEIvkFIR4qX6r7G…