Michael P Andersen, Sam Kumar, Moustafa AbdelBaky, Gabe Fierro, John Kolb, Hyung-Sin Kim, David E. Culler, and Raluca Ada Popa, University of California, Berkeley
UCAN - User Controlled Authorization Network
A trustless, secure, local-first, user-originated, distributed authorization scheme.
UCAN Working Group
Decentralized Auth — User Controlled Authorization Networks - UCAN Working Group
Decentralization Trade Offs in AT Protocol and ActivityPub DWeb Camp 2026
Christine Lemmer Webber is lead author and co-editor of the W3C ActivityPub specification. Daniel Holmgren is Head of Protocol at Bluesky, working on the AT Protocol specification at the IETF. Join us for a discussion on decentralization trade-offs and other design decisions in the two protocols, and what that means for different architectures, structures, and even future points of convergence. Moderated by Boris Mann
Solving AT Protocol's Centralized Identity - blog.boscolo.co
I spent the weekend building a proof of concept for a truly decentralized DID method using Farcaster's battle-tested identity system. Here's why AT Protocol needs this third DID option.
Protocol: How Control Exists after Decentralization by …
How Control Exists after Decentralization by Galloway, …
Decentralised Identity 🤝 Mesh Networking - Thinking with portals
How you can invite your Bluesky friends into your Tailscale network using an OIDC shim
a practical guide to decentralization (for my friends) - tim's tinkerings
AIP: Agent Identity Protocol for Verifiable Delegation Across MCP and A2A
AI agents increasingly call tools via the Model Context Protocol (MCP) and delegate to other agents via Agent-to-Agent (A2A), yet neither protocol verifies agent identity. A scan of approximately 2,000 MCP servers found all lacked authentication. In our survey, we did not identify a prior implemented protocol that jointly combines public-key verifiable delegation, holder-side attenuation, expressive chained policy, transport bindings across MCP/A2A/HTTP, and provenance-oriented completion records. We introduce Invocation-Bound Capability Tokens (IBCTs), a primitive that fuses identity, attenuated authorization, and provenance binding into a single append-only token chain. IBCTs operate in two wire formats: compact mode (a signed JWT for single-hop cases) and chained mode (a Biscuit token with Datalog policies for multi-hop delegation). We provide reference implementations in Python and Rust with full cross-language interoperability. Compact mode verification takes 0.049ms (Rust) and 0.189ms (Python), with 0.22ms overhead over no-auth in real MCP-over-HTTP deployment. In a real multi-agent deployment with Gemini 2.5 Flash, AIP adds 2.35ms of overhead (0.086% of total end-to-end latency). Adversarial evaluation across 600 attack attempts shows 100% rejection rate, with two attack categories (delegation depth violation and audit evasion through empty context) uniquely caught by AIP's chained delegation model that neither unsigned nor plain JWT deployments detect.
An equitable company - Roomy
decentralized networking is best realized with decentralized ownership
Proposal: OAuth Scopes · bluesky-social atproto · Discussion #3655
Note: a more complete proposal was published in July 2025: https://github.com/bluesky-social/proposals/tree/main/0011-auth-scopes We’re continuing work on rolling OAuth out to the atproto network. ...
Building AIP: An ATProtocol Authorization Gateway - Nick's Blog
OAuth is the first challenge developers face in the atmosphere. This post is about AIP, the authorization gateway we built at Graze Social to alleviate some of the pain.
Authenticated Transfer: Architecture Overview
Authenticated Transfer (AT) is a collection of protocol components that together provide a generic framework for interoperable social web applications, using global aggregations of interlinked, self-certifying data records. This informational document provides an overview of the entire system, as implemented in late 2025. Some of those components may be in scope as work for the IETF, while other components may not. Many components are general-purpose and may find use outside of the context of AT. The intent of this document is to provide context for how all the components can fit together for certain use cases.
Working to Decentralize FedCM - AT Protocol
Bluesky Social PBC have given a grant to Emelia Smith, an Invited Expert with the FedID Working Group, to work on FedCM with the goal of making FedCM really work for the decentralized web.
