Cross App Access (XAA)

Cross App Access (XAA) is the informal name for the OAuth pattern, specified in the IETF draft Identity Assertion JWT Authorization Grant (draft-ietf-oauth-identity-assertion-authz-grant), in which an enterprise identity provider brokers the connection between two applications so one can call the other's API on a user's behalf without a per-user consent screen. The draft's own abstract uses the name; it is an active IETF working group draft, not yet an RFC, as of October 2026.

The problem XAA targets is app-to-app and agent-to-app sprawl: every time an employee clicks "connect" between two SaaS tools or authorizes an AI agent, a long-lived grant appears that the identity team never sees and cannot revoke centrally. With XAA the requesting app asks the IdP for an ID-JAG, the IdP applies admin policy, and the resource app trusts the result because it already trusts the same IdP for SSO. The draft has co-authors from Okta and Ping Identity, and the Model Context Protocol adopted it as the Enterprise-Managed Authorization extension. Its reach is limited to cases where both apps federate with the same IdP; cross-organization delegation still needs other mechanisms.

See also: ID-JAG, MCP authorization, agentic identity, SSO, securing AI agent identities, agent identity standards map 2026