# Standards & specifications

Specs, protocols, identity, policy and observability — verified against primary sources.

- [OAuth 2.0](oauth-2-0.md) — Delegated, scoped access to an HTTP service without sharing credentials.
- [W3C PROV](w3c-prov.md) — Interoperable model of provenance: entities, activities, agents.
- [PKCE — RFC 7636](pkce.md) — Proof Key for Code Exchange; protects auth-code flows from interception.
- [gRPC / Protocol Buffers](grpc-protobuf.md) — Typed RPC and efficient binary serialisation with generated stubs.
- [OAuth Token Exchange — RFC 8693](token-exchange.md) — Narrowing or translating authority for downstream services.
- [mTLS-bound tokens — RFC 8705](mtls-bound-tokens.md) — Sender-constrains tokens to a client via mutual TLS.
- [Zero trust architecture (NIST SP 800-207)](zero-trust.md) — No implicit trust based on network location.
- [JSON Schema](json-schema.md) — Validation vocabulary; underpins strict tool arguments and structured output.
- [GraphQL](graphql.md) — Typed query language with introspection and client-specified responses.
- [DPoP — RFC 9449](dpop.md) — Application-layer sender-constraining without mutual TLS.
- [HTTP Message Signatures — RFC 9421](http-message-signatures.md) — End-to-end integrity and authenticity across intermediaries.
- [Structured Outputs](structured-outputs.md) — Constraining model output to conform to a supplied schema.
- [Model Context Protocol (MCP)](mcp.md) — Agent-to-tool protocol: hosts, clients, servers, tools, resources, prompts over JSON-RPC.
- [OAuth 2.0 Security BCP — RFC 9700](oauth-2-0-security-bcp.md) — Current best practice; deprecates insecure OAuth modes.
- [Agent2Agent (A2A)](a2a.md) — Agent-to-agent protocol: capability discovery, delegation, long-running tasks, streaming.
- [OpenAPI](openapi.md) — HTTP API contracts: ops, schemas, security metadata; machine- and human-readable.
- [DCAT](dcat.md) — Catalogue vocabulary for datasets, data services, endpoint URLs, publishers and licences.
- [DCAT-AP](dcat-ap.md) — Application profile for federated public data catalogue metadata.
- [DQV](dqv.md) — Quality annotation vocabulary used alongside DCAT for metadata-quality signals.
- [AsyncAPI](asyncapi.md) — Protocol-agnostic description of channels, operations and messages.
- [Arazzo](arazzo.md) — Machine-readable workflow narratives over API descriptions.
- [SPIFFE / SPIRE](spiffe-spire.md) — Workload identity and attestation for software systems.
- [Open Policy Agent (OPA)](opa.md) — Policy-as-code: decoupled decisions across the stack.
- [OpenTelemetry](opentelemetry.md) — Traces, metrics and logs for end-to-end observability.