#449 - Decoded - Transaction Tokens with George Fletcher

<p>George Fletcher joins Jeff Steadman and Sean O&#39;Dell for a Decoded deep dive into transaction tokens (Txn-Tokens), the OAuth Working Group specification designed to secure requests as they move across microservices. George explains the problem transaction tokens solve: hop to hop security gaps, replayed access tokens, and the difficulty of tracking a single transaction across a graph of internal services. The conversation covers the anatomy of a transaction token, including the subject, audience, scope, and TXN claims, how a token&#39;s time to live should be scoped to the transaction itself, and why immutable parameters prevent tampering mid chain. George and Sean also explore how transaction tokens apply to AI agents and delegated authorization, referencing draft work on agent specific claims and cross domain trust. The episode closes with practical starting points for organizations of any size, including open source options and where to track the specification through the IETF OAuth Working Group.</p><p><br></p><p>Resources mentioned in this episode:</p><p><br></p><p>Transaction Tokens (base draft): https://www.ietf.org/archive/id/draft-ietf-oauth-transaction-tokens-11.html</p><p><br></p><p>Transaction Token Chaining Profile (Cross Domain Trust): https://www.ietf.org/archive/id/draft-fletcher-transaction-token-chaining-profile-02.html</p><p><br></p><p>Transaction Tokens for Agents: https://www.ietf.org/archive/id/draft-araut-oauth-transaction-tokens-for-agents-00.html</p><p><br></p><p>Tokenetes: https://tokenetes.io/</p><p><br></p><p>OAuth Working Group: https://github.com/oauth-wg</p><p><br></p><p><br></p><p>Decoded by Identity at the Center:</p><p><br></p><p>Jim McDonald: https://www.linkedin.com/in/jimmcdonaldpmp/</p><p><br></p><p>Jeff Steadman: https://www.linkedin.com/in/jeffsteadman/</p><p><br></p><p>Sean O&#39;Dell: https://www.linkedin.com/in/seanodentity/</p><p><br></p><p>Visit the show on the web at http://idacpodcast.com</p><p><br></p><p>00:15 Introduction and catching up with Sean O&#39;Dell</p><p>01:25 Introducing today&#39;s topic, transaction tokens and zero trust</p><p>02:26 George Fletcher joins the show</p><p>02:41 George&#39;s path into identity, from AOL to the Liberty Alliance</p><p>04:22 The problem that led to transaction tokens at Verizon Media</p><p>09:01 What a transaction token is, in plain terms</p><p>10:25 The specific problem transaction tokens solve</p><p>11:43 Transaction tokens versus a short lived access token</p>