Hi all, I've opened a PR against draft-skyfire-oauth-using-kyapay-tokens: https://github.com/skyfire-xyz/draft-skyfire-oauth-using-kyapay-tokens/pull/3
Two changes: 1. Layer characterization (§2.1, §3.4, §6.3). The draft describes bot managers as operating at the network/transport layer (L3/L4). In practice, they operate inline at the application layer (L7): they terminate and inspect HTTP, inject client-side instrumentation, and score behavioral and fingerprint signals — none of which is available at L3/L4. The PR corrects the definition accordingly. 2. Reframing §6.3 around self-identification and policy. The section is rewritten so a KYA token turns the detection model into a self-identification model: by presenting a valid token, an agent identifies itself as automated up front, the bot manager verifies it (signature against the issuer's keys, issuer trust, validity, audience) and classifies the request as a verified agent — so it need not run its behavioral/fingerprinting heuristics to prove the traffic is automated. Untokened traffic falls back to the standard pipeline. Crucially, identification is decoupled from admission: token verification provides authenticated context (hid, apd, aid), but admission remains a site-configured policy decision (admit, rate-limit, step-up, deny), not a bypass. Feedback welcome, on the PR. Thanks, Srini
_______________________________________________ OAuth mailing list -- [email protected] To unsubscribe send an email to [email protected]
