Enterprise-Managed Authorization Charter

community/interest-groups/enterprise-managed-authorization Changed · +12 / -3 lines

 
 > Charter for the MCP Enterprise-Managed Authorization Interest Group.
 
+<Note>
+  As of 2026-08-17 this Interest Group is folded into the [Authorization
+  IG](/community/interest-groups/auth). EMA interoperability and deployment
+  progress is presented as agenda slots on the Auth IG call, discussion
+  continues in `#auth-ig` threads, and `#enterprise-managed-auth-ig` is
+  archived. This page is kept for reference.
+</Note>
+
 ## Group Type
 
 **Interest Group**

 
 ## Changelog
 
-| Date       | Change          |
-| ---------- | --------------- |
-| 2026-06-16 | Initial charter |
+| Date       | Change                                             |
+| ---------- | -------------------------------------------------- |
+| 2026-08-17 | Folded into the Authorization IG; channel archived |
+| 2026-06-16 | Initial charter                                    |
 

community/interest-groups/enterprise-managed-authorization First recorded · 65 lines, first recorded

# Enterprise-Managed Authorization Charter ## Group Type ## Mission Statement ## Scope ### In Scope ### Out of Scope ### Related Groups ## Leadership ## Membership ## Operations ## Changelog

The first capture of this source. The page was already there, and this is what it said.

# Enterprise-Managed Authorization Charter

> Charter for the MCP Enterprise-Managed Authorization Interest Group.

## Group Type

**Interest Group**

## Mission Statement

The Enterprise-Managed Authorization Interest Group provides a venue for identity-provider vendors, MCP client implementers, and MCP server operators to coordinate on real-world adoption of the [Enterprise-Managed Authorization extension](/extensions/auth/enterprise-managed-authorization) (`io.modelcontextprotocol/enterprise-managed-authorization`). The extension's ID-JAG flow only delivers value when an enterprise IdP, an MCP client, and an MCP server's authorization server all interoperate end to end — this group exists to gather deployment experience, surface compatibility gaps between independent implementations, and feed validated problems back to the [Authorization IG](/community/interest-groups/auth) and the [ext-auth](https://github.com/modelcontextprotocol/ext-auth) specification.

## Scope

### In Scope

* **Interoperability reports**: documented results of pairing specific IdPs, MCP clients, and MCP authorization servers through the full ID-JAG exchange, including what worked, what required workarounds, and what failed
* **Conformance scenario input**: identifying the assertions an EMA conformance suite should make (ID-JAG validation, audience and issuer checks, claim mapping, account linking, error handling) and contributing scenarios to the [conformance](https://github.com/modelcontextprotocol/conformance) repository
* **Deployment patterns**: comparing notes on tenant isolation, admin-consent flows, JIT provisioning, claim-to-permission mapping, and token-lifetime choices observed in production rollouts
* **IdP capability gaps**: cataloguing where existing IdP products cannot yet issue or validate ID-JAGs as specified, so implementers know what to expect and IdP vendors have a shared backlog
* **Spec clarification requests**: collecting ambiguities and underspecified behaviour discovered during implementation and routing them to the [ext-auth](https://github.com/modelcontextprotocol/ext-auth) repository as issues or PRs

### Out of Scope

* **Other authorization profiles**: Client Credentials, DPoP, Workload Identity Federation, and the core OAuth 2.1 flow belong to the [Authorization IG](/community/interest-groups/auth)
* **General enterprise deployment topics**: networking, packaging, and host-application rollout concerns that are not specific to the ID-JAG flow
* **End-user product configuration walk-throughs**: the IG discusses patterns, not step-by-step setup for individual IdP or client products. Vendor-reported constraints on what an IdP can or cannot implement *are* in scope as deployment experience
* **Competitively sensitive or non-public business information**, per the [MCP Antitrust Policy](/community/antitrust)

### Related Groups

* **[Authorization IG](/community/interest-groups/auth)**: parent group for all MCP authorization work; EMA spec changes are incubated there and this IG's findings feed its agenda
* **[Security IG](/community/interest-groups/security)**: token-audience confusion, issuer validation, and account-linking risks in the ID-JAG flow sit at the boundary between the two groups
* **SDK Maintainers**: SDKs ship the EMA client implementation; interop findings inform cross-SDK behaviour and defaults

## Leadership

| Role        | Name          | Organization | GitHub                                     | Term    |
| ----------- | ------------- | ------------ | ------------------------------------------ | ------- |
| Facilitator | Paul Carleton | Anthropic    | [@pcarleton](https://github.com/pcarleton) | Initial |
| Facilitator | Aaron Parecki | Okta         | [@aaronpk](https://github.com/aaronpk)     | Initial |

Sponsored by Den Delimarsky ([@localden](https://github.com/localden), Lead Maintainer).

## Membership

Open to anyone; no formal membership or approval step is required to join the channel, attend calls, or contribute. The group particularly seeks participants from enterprise IdP vendors, MCP client implementers shipping EMA support, and MCP server operators integrating with an enterprise IdP.

Join the `#enterprise-managed-auth-ig` channel on the [MCP Contributors Discord](/community/communication#discord) or open a thread in the Authorization category of [GitHub Discussions](https://github.com/modelcontextprotocol/modelcontextprotocol/discussions). Calls are open and attendance is optional — async participation via Discord and GitHub is equally valued.

## Operations

| Meeting      | Frequency     | Duration | Purpose                                                               |
| ------------ | ------------- | -------- | --------------------------------------------------------------------- |
| Interop Call | Every 2 weeks | 45 min   | Deployment reports, compatibility-matrix review, spec-feedback triage |

An agenda is shared in `#enterprise-managed-auth-ig` ahead of each call. Meeting notes are posted to the Authorization category in [GitHub Discussions](https://github.com/modelcontextprotocol/modelcontextprotocol/discussions).

Discord: [#enterprise-managed-auth-ig](https://discord.com/channels/1358869848138059966/1516754292294287360) · [invite](https://discord.gg/xw55W9Sw5s)

## Changelog

| Date       | Change          |
| ---------- | --------------- |
| 2026-06-16 | Initial charter |