Hi, Added to my github draft: https://yaron-zehavi.github.io/oauth-authority-metadata/draft-zehavi-oauth-authority-metadata.html
See section 9 on authority metadata binding. I'll collect more feedback before publishing a revision on datatracker. Yaron Classification: GENERAL -----Original Message----- From: Blake Morrison <[email protected]> Sent: Tuesday, October 13, 2026 8:13 AM To: [email protected]; Yaron ZEHAVI <[email protected]> Cc: Omri Gazitt <[email protected]> Subject: [OAUTH-WG] Re: 回复：Re: Call for interest: fine-grained authorization in OAuth (IETF 126 follow-up) [You don't often get email from [email protected]. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ] This message is from an external sender - be cautious, particularly with links and attachments. Hi Yaron, Thankyou, amb covers it. The resource needs it because of your fourth point. Its metadata only tightens what the AS issues if the AS used it. Without amb the resource can't see whether it did. Rejecting tokens issued before an update doesn't close that either. 9.3 lets the AS cache. A token issued after the update can still have been checked against the old description. With the digest in amb the resource can refuse any token that doesn't carry the current one and refuse "local" for scopes where it wants its own description applied. Blake This message and any attachment ("the Message") are confidential. If you have received the Message in error, please notify the sender immediately and delete the Message from your system, any use of the Message is forbidden. Correspondence via e-mail is primarily for information purposes. RBI neither makes nor accepts legally binding statements via e-mail unless explicitly agreed otherwise. Information pursuant to § 14 Austrian Companies Code: Raiffeisen Bank International AG; Registered Office: Am Stadtpark 9, 1030 Vienna, Austria; Company Register Number: FN 122119m at the Commercial Court of Vienna (Handelsgericht Wien). _______________________________________________ OAuth mailing list -- [email protected] To unsubscribe send an email to [email protected]
