# cross-app-access

Source: https://startwithidentity.com/glossary/cross-app-access/
Last updated: 2026-10-30
License: content by Start with Identity. Cite the source URL.

---

Cross App Access (XAA) is the informal name for the OAuth pattern, specified in the IETF draft Identity Assertion JWT Authorization Grant ([draft-ietf-oauth-identity-assertion-authz-grant](https://datatracker.ietf.org/doc/draft-ietf-oauth-identity-assertion-authz-grant/)), in which an enterprise identity provider brokers the connection between two applications so one can call the other's API on a user's behalf without a per-user consent screen. The draft's own abstract uses the name; it is an active IETF working group draft, not yet an RFC, as of October 2026.

The problem XAA targets is app-to-app and agent-to-app sprawl: every time an employee clicks "connect" between two SaaS tools or authorizes an AI agent, a long-lived grant appears that the identity team never sees and cannot revoke centrally. With XAA the requesting app asks the IdP for an [ID-JAG](https://startwithidentity.com/glossary/id-jag/), the IdP applies admin policy, and the resource app trusts the result because it already trusts the same IdP for SSO. The draft has co-authors from [Okta](https://startwithidentity.com/vendors/iam/okta/) and [Ping Identity](https://startwithidentity.com/vendors/iam/ping-identity/), and the Model Context Protocol adopted it as the Enterprise-Managed Authorization extension. Its reach is limited to cases where both apps federate with the same IdP; cross-organization delegation still needs other mechanisms.

See also: [ID-JAG](https://startwithidentity.com/glossary/id-jag/), [MCP authorization](https://startwithidentity.com/glossary/mcp-authorization/), [agentic identity](https://startwithidentity.com/glossary/agentic-identity/), [SSO](https://startwithidentity.com/glossary/sso/), [securing AI agent identities](https://startwithidentity.com/guides/machine-identity/securing-ai-agent-identities/), [agent identity standards map 2026](https://startwithidentity.com/reports/agent-identity-standards-map-2026/)