Iman, Cliff, Thanks, both. I agree it's a distinct case from Use Case 5, and "terminal disposition" names the gap better than I did.
The records back Cliff's "pending" state. At the resource server, the client that did sign in during an interactive session left the same trace as the two that gave up: a 401, a fetch of the protected resource metadata, then nothing until its first request with a token. Our test user was scripted, so that silence lasted about a second. With a person it lasts as long as they take to sign in, and the server can't tell it from a client that has stopped. On the boundary, completing the challenge gives grant-layer authority and nothing more. Binding a person's decision to a specific action is the execution-layer question the draft already keeps separate, and the proposed text says so. The issue is open with the results and proposed text, including a Section 6 change along the lines Iman suggested: https://github.com/Maisy-ML/Agent-Authorization-Use-Cases/issues/30 Placement and wording are the authors' call. Laxmikant Sharma On Fri, Sep 25, 2026 at 7:46 AM Cliff Singletary <[email protected]> wrote: > +1 to capturing this as a distinct case, and to the terminal-disposition > requirement. > > From the resource-server operator side: a client that goes silent after a > 401 leaves the RS unable to distinguish policy refusal, unsupported flow, > pending user interaction, and failure. All four look identical in logs, > which hurts both incident triage and audit evidence. Even a small > enumerated disposition set returned to the RS would close most of that gap. > > Happy to review proposed text when the issue is opened. > > Cliff Singletary > > > _______________________________________________ > OAuth mailing list -- [email protected] > To unsubscribe send an email to [email protected] >
_______________________________________________ OAuth mailing list -- [email protected] To unsubscribe send an email to [email protected]
