ID-JAG and Cross-App Access (XAA): Same Wire, Two Names
App-to-app and agent-to-resource calls need short-lived, audience-bound identity assertions—not shared secrets in the agent. ID-JAG is the IETF draft; XAA is how Okta names the same pattern on the wire.
This article explains terminology and architecture for buyers evaluating agent and API connectivity. It is not a conformance certificate for your IdP or every downstream resource server.
When an AI agent or backend application calls another organization’s API, the hard question is not only “who is logged in?” It is which application may act, for which user or workload, toward which audience—and for how long.
ID-JAG in one paragraph
Identity Assertion Authorization Grant (ID-JAG) is an OAuth-family pattern for brokering identity across applications: the identity provider issues a short-lived assertion; the resource authorization server exchanges it for an access token bound to the right audience. EmpowerID implements issuance (token exchange) and consumption (JWT bearer) with AuthZEN decisions at mint and at enforcement points such as the Governed Tool Gateway.
Where XAA fits
Cross-App Access (XAA) is Okta’s product name for the same cross-application access problem. In RFPs you may see XAA; in IETF drafts you will read ID-JAG. Compare behaviors—assertion lifetime, audience binding, protected resource metadata—not trademark labels alone.
What ID-JAG does not replace
- Enterprise authorization, SoD, and recertification on the fabric spine
- Per-tool AuthZEN on MCP tools/call
- Proof that a downstream business mutation occurred—receipts prove the governed boundary
See the Cross-application access (ID-JAG) domain on the Standards page for RFC-level rows and maturity labels, and the Governed Tool Gateway for how consumption stacks with delegation and receipts.
Related
Standards and protocols →