Previous Document links

Feeding into this specification is the agreement outlined here:

Documents and proposals prior to this

Summary v1.2 4k compact passports proposal (previous proposal from this working group on compact 4k passports)
Passport design doc (early document outlining the work done in the DRS + Passports group feeding into forming this technical working group to explore Passports v1.2)

Specification details of the proposed work-order v1.2

(reasonably broad, 10 or so? Kurt to start NiH requirements for a work-order token)

Requirement	Rationale / Use Case
E.g. Must be unforgeable (?)	E.g. A key requirement of capability systems, but also in general just obviously a requirement that arbitrary external systems shouldn’t be able to forge valid tokens

Passport: container for Visas

Visa: dataset permissions tied to an identity

Passport-Scoped Access Token: An OIDC access token used to obtain a Work Order

Work Order Token: revocable, minimally-scoped, identity-tied token used for batch processing

Take the access token to a new endpoint to get a Work Order Token

Not /userinfo as in 1.0 - should not require the same token that returns PII.

Introspection endpoint is called to obtain a work order token