Deonté — Appreciate the careful framing, and you are right to hold the line between candidate tests and settled results.
On the evidence question, I will be direct: I do not know of an existing OAuth specification that makes pre-expiry acceptance timestamps, settlement policy, or revocation exceptions interoperable across administrative domains. RFC 7009 covers the admission cutoff — whether a token is still good — but it says nothing about effects authorized before revocation that settle after it. The closest operational model I know is card authorization/capture: the authorization is recorded at one moment, the capture settles later inside a documented window, and the network's rules decide what is valid rather than either endpoint's clock. That works because the card network is a single administrative domain. Across domains, I agree it is an open question, and it is the piece I would most like to see the group take up. We have mapped negative tests per requirement on our side and I will post them. Caleb On Sun, 18 Oct 2026 03:29:37 +0000 (UTC), Deonté O’dell Watts <[email protected]> wrote: > Hello OAuth WG, > > Thank you to Caleb and other participants for the concrete bounded-settlement > examples. I am retaining the distinction between authorization recorded > before expiry, an external party's acceptance, settlement inside a documented > window, and cases where the downstream state cannot be established. > > These examples identify candidate negative tests, not verified results or a > settled normative status model. A remaining evidence question is how an > independent relying party can authenticate the pre-expiry acceptance > timestamp, the governing settlement policy and deadline, and any effective > revocation exception across administrative domains. If participants know of > existing specifications or published test cases that make those claims > interoperable, a precise pointer would be helpful. > > The draft is an individual Internet-Draft. I will not infer WG agreement, new > OAuth protocol requirements, or independent validation from these discussions. > > Regards, > Deonté O’dell Watts > Independent Researcher | GoodShyt Group Inc. > ORCID: 0009-0005-8586-3650 > _______________________________________________ > OAuth mailing list -- [email protected] > To unsubscribe send an email to [email protected] _______________________________________________ OAuth mailing list -- [email protected] To unsubscribe send an email to [email protected]
