I wrote a much more narrative version of what this is useful for here: https://aaronparecki.com/2025/05/12/27/enterprise-ready-mcp

It isn't exclusive to MCP, it applies to any regular OAuth connection between apps under the same enterprise IdP too, but MCP is a topical example at the moment.

In big systems it's often the case, for better or worse, that two systems don't share a connection to a central auth server.

This spec appears to outline how a user logged into one is automatically logged into another using cryptographically signed tokens.

Appendix A: Use Cases offers several examples.