WIF works far better when you don’t want humans in the loop. For example, we’d do our development on cloud instances, those have identity linked to our humans via our IdP. Our IdP governs all access, for example: it lets devs use Datadog. If an agentic workflow needs Datadog access and the MCP requests OAuth that slows the loop down. At the same time, we don’t want Service Accounts everywhere because we need to be able to answer “who” a lot for compliance reasons.

Oauth assumes interactivity

The dpop thing is oauth. It’s providing a significant enhancement to preventing token replay, or token theft, at the cost of some request size bloat + an additional key verification.