COAZ Framework 1.0 – defines COAZ (Compatible with OpenID AuthZEN, pronounced “cozy”), a protocol-neutral framework for mapping the information model of an arbitrary protocol or interface into a request to the Authorization API. The inputs of an incoming operation are projected, through a declarative mapping, into the Subject-Action-Resource-Context (SARC) model. Mapping values are literal constants or expressions, written by default in Common Expression Language (CEL). The framework defines no mapping for any specific protocol; it defines the common model and the conformance contract that individual COAZ bindings fulfil.

COAZ-MCP Binding 1.0 – the COAZ binding for the Model Context Protocol (MCP). Defines how MCP JSON-RPC messages are mapped into Authorization API requests, enabling MCP gateways and servers to perform fine-grained, parameter-level authorization through an AuthZEN Policy Decision Point.

AuthZEN Access Request and Approval Profile 1.0 – an extension profile that allows a Policy Enforcement Point to submit an access request when an authorization decision is denied but requestable. It adds a requestable denial context, an access request endpoint, a task handle for the asynchronous workflow that resolves the denial, and a re-evaluation completion mode that lets the Policy Decision Point remain authoritative at enforcement time after approval. A denied decision remains a denial and must not be treated as access.

AuthZEN Profile for Obligations 1.0 – a profile for expressing obligations, by which a Policy Decision Point can attach one or more mandatory, machine-readable actions to an authorization decision. A Policy Enforcement Point that receives such a decision must perform every attached action in order to honor it. Defines the Obligation object model, PEP compliance semantics, a set of Normative Obligation Types, and a discovery and negotiation mechanism by which PDPs and PEPs establish which Obligation Types they mutually support.