The drafts tracker

Every status and date below is from the IETF datatracker, retrieved 2026-11-01. The page is a snapshot: the SCIM working group meets next at IETF 127 on 2026-11-19, and draft statuses, revisions, and adoption decisions move at meeting tempo. Refreshing this tracker after that session is planned future maintenance; until then, the dated snapshot is the claim this page makes.

The history explains the present. The SCIM working group was proposed in May 2012 and started that June; the core RFCs landed in September 2015; the group concluded in July 2016 and the protocol sat still for five years. The re-charter of 2021-10-22 put revisions of RFC 7642, RFC 7643, and RFC 7644 at the top of the scope, alongside events, soft deletes, and multi-value paging. Both revision documents the group adopted have since expired: draft-ietf-scim-use-cases-reloaded (the RFC 7642 revision, expired 2026-01-19) and draft-ietf-scim-roles-entitlements (expired 2025-10-16). The charter's milestone table records none of its dated targets as met. What the working group has shipped instead is the 2025-2026 update wave (RFC 9865, RFC 9944, RFC 9967) and the coordinated errata sweep of 2025-10-28; the working group moved to the Security Area in January 2024, and its Area Director since March 2026 is Christopher Inacio (datatracker WG history, retrieved 2026-11-01).

The live action is therefore in the individual submissions below, none of which is yet a working-group document. The IETF 126 SCIM session (2026-07-24) gave agenda time to five of them, which is where the clustering described after the table became visible.

One further document belongs in every reading of this space, and it is not on the active list:draft-zollner-scim-interop-profile is expired, revision or adoption pending, still a normative dependency of IPSIE. Its latest revision is -01, dated 2026-04-15, the datatracker marks it "Expired & archived", and the IPSIE profile draft requires conformance to it. The expiry after the IETF 126 session that discussed it is the strongest available signal that a revision or an adoption decision is pending; the entry stays in the expired state until a datatracker page says otherwise.

Four drafts form one coherent vendor-side agenda, with Okta and Microsoft authorship overlapping across documents: the interop profile (Zollner, Okta), the agent resource (Wahl and Dingle, Microsoft; Zollner, Okta; Kazzouzi, Nextident), group membership (Zollner), and the IPSIE profile (Schreiber, CrowdStrike; Zollner). The through-line is deployment realism: restrict the base spec's optionality into a normative baseline, then solve the two places 100k-to-1M-scale groups and AI agents break it.

The interop profile is the cluster's foundation and the expired entry above: a profile that turns RFC 7644's optional features and variations into a common mandatory baseline for the many-to-many IdP-to-SP integration model. It drew a 15-minute slot at IETF 126, and the IPSIE profile normatively depends on it, which keeps a lapsed document load-bearing in practice.

The agent resource (draft-wzdk-scim-agent-resource) defines a first-class Agent resource at /Agents with URNurn:ietf:params:scim:schemas:core:2.0:Agent: a REQUIRED server-uniqueagentUserName, displayName, active, optionaldescription, and multi-valued owners that may reference Users, Groups, or other Agents. It augments the Group members definition so $ref and typecan point at an Agent. Agents need the same lifecycle signals and group and entitlement plumbing users have; the draft gives them the user-shaped wiring. It took the largest single agenda item at IETF 126 (30 minutes, listed as "AI Agent Resource Extension"), and the meeting minutes record the outcome: the call for working-group adoption failed for insufficient consensus, with terminology and template-versus-instance disputes minuted (minutes of 2026-07-24, retrieved 2026-11-01). The draft remains an active individual submission. The OAuth-side reading of agent identity, where agents act as clients rather than as provisioned records, lives on the companion lab-site:the agent-auth lab-site.

Group membership (draft-zollner-scim-group-membership) attacks unboundedmembers arrays: a top-level GroupMembership resource with immutable group andmember complexes, so an individual membership can be paginated (cursor pagination RECOMMENDED, per RFC 9865), filtered (eq on group.value and member.value plus their AND combination), and bulk-managed. A Group extension carries membersEmbedded, telling clients whether the embedded members list is complete. The motivation section is the ecosystem's own behavior: implementations that refuse to return members for 100k-member groups. The document was reposted under its current name on 2026-10-28, replacing draft-zollner-scim-group-members; the IETF 126 agenda still cites the old name.

The IPSIE profile (draft-schreiber-scim-ipsie-profile) maps SCIM onto the IPSIE Account Lifecycle assurance levels. AL1 covers deprovisioning (deactivate via PATCH, delete, filters on userName, externalId, and emails). AL2 covers user and group management, and its requirements are the closest thing the ecosystem has to a convergence target: OAuth 2.0 client credentials with JWT client authentication per RFC 7523 REQUIRED, the password attribute MUST NOT be supported or sent, bulk and multi-attribute PATCH required, a 25-requests-per-second per-tenant rate floor, and a defined filter set. AL3 (role management) is deferred to a future revision. Conformance requires also conforming to the interop profile, which is what keeps the expired document in the story.

One author, Saurabh Kushwaha (Oracle), filed four drafts in three months, covering governance, identity binding, tenancy, and pagination. They read as infrastructure proposals: each defines a resource or extension, a discovery block, and the state machines around it.

Agent governance extends the wzdk Agent resource with alifecycleState complex grounded in ISO/IEC 24760-1 states (established, active, suspended, archived) plus one agent-specific value, quarantined, with a transition graph servers MUST enforce. autonomyLevel (autonomous, semiAutonomous, supervised) is descriptive metadata, and the draft states it is not an authorization control. DID/VC binding attaches DIDs and Verifiable Credentials to Users through a read-only extension and a separate IdentityBinding resource, without persisting DID documents or credential payloads. Tenancy proposes a portable Tenant resource with a lifecycle state machine, tenant-membership extensions, and a normative tenant-context resolution rule (effective tenant is the highest-precedence authenticated indicator, defaulting to a JWT tenant_id claim, then path, header, subdomain, or body, with disagreements rejected and uniform 404s against tenant enumeration), plus a provisionalSCIM-Tenant-Id header. Attribute pagination attacks the same unbounded-members problem as group membership from inside the attribute: attributeCount andattributeCursor parameters, an attributePagination discovery block, and a fail-closed attributePaginationRequired error instead of silent truncation. Its header declares "Updates: 7643, 7644 (if approved)", the only draft in the table to claim an update relationship to the base RFCs.

The overlap to watch is pagination: attribute-cursor pagination and group membership both answer "what happens when members does not fit in a response", one by paginating inside the attribute, the other by promoting each membership to its own resource. The overlaps beyond it are partial rather than direct: agent governance extends the agent resource it depends on, and tenancy intersects everything while replacing nothing. What happens at adoption time is the open question this page snapshots: the vendor cluster arrives with deployment weight and an expired-but-load-bearing profile, the Oracle cluster arrives with breadth and state-machine rigor, and the only recorded adoption call so far (the agent resource) failed for insufficient consensus. The IETF 127 SCIM session on 2026-11-19 is the next data point; this tracker refreshes after it.