Toshio — the revocation-vs-execution-start ordering is the right question to be stuck on. Disclosure: I build a commercial product in this space (Cerydora), so treat this as requirements from a would-be verifier of your bundle, not design input. For a portable evidence bundle to be worth exporting, an offline verifier needs to establish three things without calling the issuer:
1. Who granted it. The authorization has to bind to a stable identifier for the human issuer, not a username or email that can be renamed or reassigned. If the issuer's account is disabled between grant and execution, the verifier should be able to see that from the bundle. 2. Whether it was still in force at execution-start. "One-use" and "not yet revoked" are necessary, not sufficient; the issuer's standing to grant at that moment matters as much as the grant's own validity window. The ordering claim should be about grant standing at execution-start, and it should be able to say "unknown" — an ordering the bundle can't establish should fail closed, not default to valid. 3. Whether execution stayed inside it. Signed external execution evidence answers "what ran"; the verifier also needs the granted scope in the same bundle to compare against, and a three-valued result (within / outside / not evaluated) so missing effect evidence is never silently a pass. On OAuth alignment: the one-use grant and execution-start boundary are clear as you describe them; what's underdetermined is the verifier's obligations. draft-jackson-wimse-evaluation-02 is worth reading for that framing, and draft-gilda-wimse-agent-audit-record-01 for the decision/effect/agreement record shape. Vocabulary I use for this, if useful: https://doi.org/10.5281/zenodo.22918825. Glad to run an exported bundle through an independent verifier and report what it can and can't establish. — Cliff Singletary, Cerydora
_______________________________________________ OAuth mailing list -- [email protected] To unsubscribe send an email to [email protected]
