Hi Mohamad, Yes. Our Gate tests cover the executor side: a signed receipt covers a $400 USD payout to acct_x. Changing the amount to $9,999.99 is refused before any provider call: https://github.com/emiliaprotocol/emilia-protocol/blob/62a4310b82af658cbfb0ec1c83f8405ed3eb3bfe/packages/gate/adapters/stripe.test.js#L71
That test uses synthetic signoffs and a mock Stripe provider. It does not establish human user verification. Our individual AE-CHALLENGE -07 draft <https://www.ietf.org/archive/id/draft-schrock-ae-challenge-07.html#section-1.1> describes requesting evidence for a resource-derived action and naming acceptable presentation profiles. Section 1.1 keeps native OAuth transaction authorization separate rather than replacing it. Could we use the unchanged approval followed by an amount mutation as a shared PSEA negative case, checking the binding through to dispatch? We haven't demonstrated PSEA interoperability yet. Best, Iman On Wed, 14 Oct 2026 18:28:52 +0300, Mohamad Khalil Yossif <mohamad= [email protected]> wrote: > Dapeng, all, > > Yes to the direction. One question about where item 2 ends. > > For most requests the negotiation ends in a token with the right > fine-grained authority. For a high-consequence action the resource > server may need more: an approval of the exact parameters, by the > person, at the moment it runs. RFC 9470 lets the resource server ask > for stronger authentication, but not for that. Karl's Action-Bound > Approval section in draft-mcguinness-mission-runtime describes the > gate and leaves open how the approval is obtained. > > I've been working on one way to produce that evidence: a signature > on the user's own authenticator, gated by user verification, over a > canonical digest of the parameters (draft-yossif-psea-03, one > independent verifier so far). > > Is anyone else hitting this case: a valid token, the right scope, > and still a need to show that a person approved this specific > action? If so, it seems worth having the negotiation give the > resource server a defined way to ask for it. > > Mohamad
_______________________________________________ OAuth mailing list -- [email protected] To unsubscribe send an email to [email protected]
