Hello OAuth WG, Thank you to Caleb and other participants for the concrete bounded-settlement examples. I am retaining the distinction between authorization recorded before expiry, an external party's acceptance, settlement inside a documented window, and cases where the downstream state cannot be established.
These examples identify candidate negative tests, not verified results or a settled normative status model. A remaining evidence question is how an independent relying party can authenticate the pre-expiry acceptance timestamp, the governing settlement policy and deadline, and any effective revocation exception across administrative domains. If participants know of existing specifications or published test cases that make those claims interoperable, a precise pointer would be helpful. The draft is an individual Internet-Draft. I will not infer WG agreement, new OAuth protocol requirements, or independent validation from these discussions. Regards, Deonté O’dell Watts Independent Researcher | GoodShyt Group Inc. ORCID: 0009-0005-8586-3650 _______________________________________________ OAuth mailing list -- [email protected] To unsubscribe send an email to [email protected]
