  The WLCG Authorisation Working Group was formed in July 2017 with the
objective to understand and meet the needs of a future-looking Authentication
and Authorisation Infrastructure (AAI) for WLCG experiments. Much has changed
since the early 2000s when X.509 certificates presented the most suitable
choice for authorisation within the grid; progress in token based authorisation
and identity federation has provided an interesting alternative with notable
advantages in usability and compatibility with external (commercial) partners.
The need for interoperability in this new model is paramount as infrastructures
and research communities become increasingly interdependent. Over the past two
years, the working group has made significant steps towards identifying a
system to meet the technical needs highlighted by the community during staged
requirements gathering activities. Enhancement work has been possible thanks to
externally funded projects, allowing existing AAI solutions to be adapted to
our needs. A cornerstone of the infrastructure is the reliance on a common
token schema in line with evolving standards and best practices, allowing for
maximum compatibility and easy cooperation with peer infrastructures and
services. We present the work of the group and an analysis of the anticipated
changes in authorisation model by moving from X.509 to token based
authorisation. A concrete example of token integration in Rucio is presented.
