<?xml version="1.0" encoding="utf-8" standalone="yes"?><urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9" xmlns:xhtml="http://www.w3.org/1999/xhtml"><url><loc>https://notes.karlmcguinness.com/tags/aauth/</loc><lastmod>2026-04-09T11:21:00-07:00</lastmod></url><url><loc>https://notes.karlmcguinness.com/tags/agentic-identity/</loc><lastmod>2026-04-09T11:21:00-07:00</lastmod></url><url><loc>https://notes.karlmcguinness.com/tags/authorization/</loc><lastmod>2026-04-09T11:21:00-07:00</lastmod></url><url><loc>https://notes.karlmcguinness.com/</loc><lastmod>2026-04-09T11:21:00-07:00</lastmod></url><url><loc>https://notes.karlmcguinness.com/tags/mission-shaping/</loc><lastmod>2026-04-09T11:21:00-07:00</lastmod></url><url><loc>https://notes.karlmcguinness.com/notes/</loc><lastmod>2026-04-09T11:21:00-07:00</lastmod></url><url><loc>https://notes.karlmcguinness.com/tags/oauth/</loc><lastmod>2026-04-09T11:21:00-07:00</lastmod></url><url><loc>https://notes.karlmcguinness.com/tags/standards/</loc><lastmod>2026-04-09T11:21:00-07:00</lastmod></url><url><loc>https://notes.karlmcguinness.com/tags/</loc><lastmod>2026-04-09T11:21:00-07:00</lastmod></url><url><loc>https://notes.karlmcguinness.com/tags/ciam/</loc><lastmod>2026-04-05T12:00:00-07:00</lastmod></url><url><loc>https://notes.karlmcguinness.com/tags/iam/</loc><lastmod>2026-04-05T12:00:00-07:00</lastmod></url><url><loc>https://notes.karlmcguinness.com/tags/id-jag/</loc><lastmod>2026-04-05T12:00:00-07:00</lastmod></url><url><loc>https://notes.karlmcguinness.com/tags/openid-connect/</loc><lastmod>2026-04-05T12:00:00-07:00</lastmod></url><url><loc>https://notes.karlmcguinness.com/tags/delegated-authority/</loc><lastmod>2026-03-24T09:00:00-07:00</lastmod></url><url><loc>https://notes.karlmcguinness.com/tags/security-architecture/</loc><lastmod>2026-03-24T09:00:00-07:00</lastmod></url><url><loc>https://notes.karlmcguinness.com/tags/mcp/</loc><lastmod>2026-03-21T10:00:00-07:00</lastmod></url><url><loc>https://notes.karlmcguinness.com/series/open-world-oauth/</loc><lastmod>2026-03-21T10:00:00-07:00</lastmod></url><url><loc>https://notes.karlmcguinness.com/notes/open-world-oauth-still-needs-mission-shaping/</loc><lastmod>2026-03-21T10:00:00-07:00</lastmod></url><url><loc>https://notes.karlmcguinness.com/series/</loc><lastmod>2026-03-21T10:00:00-07:00</lastmod></url><url><loc>https://notes.karlmcguinness.com/notes/oauth-for-open-world-ecosystems/</loc><lastmod>2026-03-20T10:00:00-07:00</lastmod></url><url><loc>https://notes.karlmcguinness.com/tags/delegation/</loc><lastmod>2026-03-18T10:30:00-07:00</lastmod></url><url><loc>https://notes.karlmcguinness.com/tags/jwt/</loc><lastmod>2026-03-18T10:30:00-07:00</lastmod></url><url><loc>https://notes.karlmcguinness.com/tags/jwt-assertion-grant/</loc><lastmod>2026-03-18T10:30:00-07:00</lastmod></url><url><loc>https://notes.karlmcguinness.com/tags/proof-of-possession/</loc><lastmod>2026-03-18T10:30:00-07:00</lastmod></url><url><loc>https://notes.karlmcguinness.com/notes/standardize-act-across-assertion-grants-and-jwt-access-tokens/</loc><lastmod>2026-03-18T10:30:00-07:00</lastmod></url><url><loc>https://notes.karlmcguinness.com/tags/token-exchange/</loc><lastmod>2026-03-18T10:30:00-07:00</lastmod></url><url><loc>https://notes.karlmcguinness.com/tags/architecture/</loc><lastmod>2026-03-18T09:00:00-07:00</lastmod></url><url><loc>https://notes.karlmcguinness.com/series/mission-shaping/</loc><lastmod>2026-03-18T09:00:00-07:00</lastmod></url><url><loc>https://notes.karlmcguinness.com/notes/mission-shaping-is-not-enough/</loc><lastmod>2026-03-18T09:00:00-07:00</lastmod></url><url><loc>https://notes.karlmcguinness.com/tags/security/</loc><lastmod>2026-03-18T09:00:00-07:00</lastmod></url><url><loc>https://notes.karlmcguinness.com/notes/the-mission-shaping-problem/</loc><lastmod>2026-03-17T09:00:00-07:00</lastmod></url><url><loc>https://notes.karlmcguinness.com/series/mission-bound-oauth/</loc><lastmod>2026-03-15T12:00:00-07:00</lastmod></url><url><loc>https://notes.karlmcguinness.com/notes/why-mission-bound-oauth-might-be-the-wrong-answer/</loc><lastmod>2026-03-15T12:00:00-07:00</lastmod></url><url><loc>https://notes.karlmcguinness.com/notes/mission-architecture-on-aauth/</loc><lastmod>2026-03-15T09:00:00-07:00</lastmod></url><url><loc>https://notes.karlmcguinness.com/notes/client-context-and-id-jag-for-mission-bound-oauth/</loc><lastmod>2026-03-14T09:00:00-07:00</lastmod></url><url><loc>https://notes.karlmcguinness.com/tags/internet-draft/</loc><lastmod>2026-03-13T09:00:00-07:00</lastmod></url><url><loc>https://notes.karlmcguinness.com/notes/mission-bound-oauth/</loc><lastmod>2026-03-13T09:00:00-07:00</lastmod></url><url><loc>https://notes.karlmcguinness.com/notes/agents-dont-need-your-passport-they-need-your-authority/</loc><lastmod>2026-02-21T22:59:09-08:00</lastmod></url><url><loc>https://notes.karlmcguinness.com/notes/from-passports-to-power-of-attorney/</loc><lastmod>2026-02-21T22:59:09-08:00</lastmod></url><url><loc>https://notes.karlmcguinness.com/notes/governing-the-stay-not-just-the-entry/</loc><lastmod>2026-02-21T22:59:09-08:00</lastmod></url><url><loc>https://notes.karlmcguinness.com/series/you-dont-give-agents-credentials-you-grant-them-power-of-attorney/</loc><lastmod>2026-02-21T22:59:09-08:00</lastmod></url><url><loc>https://notes.karlmcguinness.com/about/</loc><lastmod>2026-02-21T00:00:00Z</lastmod></url><url><loc>https://notes.karlmcguinness.com/tags/agentic-systems/</loc><lastmod>2025-04-28T23:22:40-07:00</lastmod></url><url><loc>https://notes.karlmcguinness.com/tags/enterprise-identity/</loc><lastmod>2025-04-28T23:22:40-07:00</lastmod></url><url><loc>https://notes.karlmcguinness.com/tags/identity/</loc><lastmod>2025-04-28T23:22:40-07:00</lastmod></url><url><loc>https://notes.karlmcguinness.com/tags/platform-architecture/</loc><lastmod>2025-04-28T23:22:40-07:00</lastmod></url><url><loc>https://notes.karlmcguinness.com/notes/welcome-to-control-plane/</loc><lastmod>2025-04-28T23:22:40-07:00</lastmod></url><url><loc>https://notes.karlmcguinness.com/categories/</loc></url></urlset>