Hi Jeff, Thi, Neil, all, Jeff, this composition map helps. AIMS can assemble posture, workload credentials, proof of possession, step-up, and AuthZEN.
The remaining question I see is narrower: does the authority cover this exact consequential action, and was that authority consumed once at the effect boundary? A healthy, correctly authenticated workload might hold authority for a $50 refund and attempt $500. Posture and client binding can both succeed while the action still needs to fail. That suggests a profile point, not a parallel stack: a Gate can accept AIMS, WIMSE, and OAuth evidence upstream, recompute the frozen action at admission, and produce evidence of that decision. Would you place that in AIMS composition guidance, an AuthZEN interop profile, or separate evidence work? Best, Iman
_______________________________________________ OAuth mailing list -- [email protected] To unsubscribe send an email to [email protected]
