Standards & specifications

Specs, protocols, identity, policy and observability — verified against primary sources.

• OAuth 2.0 — Delegated, scoped access to an HTTP service without sharing credentials.
• W3C PROV — Interoperable model of provenance: entities, activities, agents.
• PKCE — RFC 7636 — Proof Key for Code Exchange; protects auth-code flows from interception.
• gRPC / Protocol Buffers — Typed RPC and efficient binary serialisation with generated stubs.
• OAuth Token Exchange — RFC 8693 — Narrowing or translating authority for downstream services.
• mTLS-bound tokens — RFC 8705 — Sender-constrains tokens to a client via mutual TLS.
• Zero trust architecture (NIST SP 800-207) — No implicit trust based on network location.
• JSON Schema — Validation vocabulary; underpins strict tool arguments and structured output.
• GraphQL — Typed query language with introspection and client-specified responses.
• DPoP — RFC 9449 — Application-layer sender-constraining without mutual TLS.
• HTTP Message Signatures — RFC 9421 — End-to-end integrity and authenticity across intermediaries.
• Structured Outputs — Constraining model output to conform to a supplied schema.
• Model Context Protocol (MCP) — Agent-to-tool protocol: hosts, clients, servers, tools, resources, prompts over JSON-RPC.
• OAuth 2.0 Security BCP — RFC 9700 — Current best practice; deprecates insecure OAuth modes.
• Agent2Agent (A2A) — Agent-to-agent protocol: capability discovery, delegation, long-running tasks, streaming.
• OpenAPI — HTTP API contracts: ops, schemas, security metadata; machine- and human-readable.
• DCAT — Catalogue vocabulary for datasets, data services, endpoint URLs, publishers and licences.
• DCAT-AP — Application profile for federated public data catalogue metadata.
• DQV — Quality annotation vocabulary used alongside DCAT for metadata-quality signals.
• AsyncAPI — Protocol-agnostic description of channels, operations and messages.
• Arazzo — Machine-readable workflow narratives over API descriptions.
• SPIFFE / SPIRE — Workload identity and attestation for software systems.
• Open Policy Agent (OPA) — Policy-as-code: decoupled decisions across the stack.
• OpenTelemetry — Traces, metrics and logs for end-to-end observability.