Hello OAuth WG, I would welcome technical feedback on an interoperability question related to agent revocation, particularly RFC 7009 and draft-chen-oauth-agent-revocation-00.
My individual Informational draft, draft-watts-oauth-agent-revocation-closure-01, distinguishes (1) acceptance of a revocation request, (2) invalidation or propagation of authority, and (3) evidence supporting a scope-limited conclusion that operations derived from a revoked authority epoch can no longer commit. https://datatracker.ietf.org/doc/html/draft-watts-oauth-agent-revocation-closure-01 One example: an agent starts an asynchronous job and obtains a derived token. The revocation service later acknowledges invalidation, but the queued job can still commit or a downstream resource server may accept cached authorization. I would appreciate feedback on three questions: 1. Does existing work already define a verifiable scoped effect-closure condition, including outstanding queued operations? 2. Is such a distinction useful for interoperability, or should closure evidence remain implementation-local? 3. If there is a gap, would narrow requirements and negative test cases be preferable to a new protocol object? Prior-art references and counterexamples would be particularly valuable. This is a request for technical review, not working-group adoption or a claim of independent implementation conformance. Regards, Deonté O'dell Watts Independent Researcher | GoodShyt Group Inc. ORCID: 0009-0005-8586-3650 [email protected] _______________________________________________ OAuth mailing list -- [email protected] To unsubscribe send an email to [email protected]
