Hi Sangam, I can offer the EMILIA reference profile for that comparison. We shared it on the AuthZEN list, and the runnable version is pinned here:
https://github.com/emiliaprotocol/emilia-protocol/tree/fd8378671ab863a47f35e18503e5ab1929ae2fcd/conformance/composition/authzen-coaz-mcp-aeb-v0.1 The executor checks the full action against a separately signed expected-action record pinned by its owner. It reserves one attempt before entering the provider callback. A changed beneficiary is refused before that entry, even when the toy PDP returns the same coarse allow. After entry, a timeout leaves the reservation unresolved. Reconciliation verifies signed evidence for the original provider and action; it cannot invoke execution again. The admission check therefore happens before dispatch. This is a single-live-instance harness. It does not establish durable custody across restarts or prove that a deployment has no bypass. It uses a toy PDP and test keys, and is an EMILIA proposal, not an adopted AuthZEN profile. The README includes the commands to rerun the cases. Best, Iman
_______________________________________________ OAuth mailing list -- [email protected] To unsubscribe send an email to [email protected]
