Hello OAuth WG participants, Thank you to Caleb for the 13 candidate negative scenarios and to Ornella for pointing to GUARDAID and Guardalpha as possible related approaches.
I will keep those contributions distinct from validated test outcomes or WG requirements. In particular, an audit chain that records when a ticket was issued or an action was dispatched does not by itself establish that a downstream system cannot subsequently commit a queued effect. That stronger conclusion appears to depend on the actual enforcement boundary, trusted timestamps, downstream cooperation, and any permitted settlement exceptions. For prior-art comparison, could the proponents point to publicly accessible versioned specifications or reproducible tests defining: (1) when a ticket is consumed versus when a consequential action commits, (2) how a revoked epoch is enforced across administrative domains, and (3) how unknown downstream paths or already-accepted obligations are represented? A precise public link and any documented limitations are sufficient; no private materials are requested. These are requests for technical references, not endorsements of an architecture, claims of physical certification, an agreement to meet, or a proposal to change OAuth standards. My revocation-closure document remains an individual Internet-Draft. Regards, Deonté O’dell Watts Independent Researcher | GoodShyt Group Inc. ORCID: 0009-0005-8586-3650 _______________________________________________ OAuth mailing list -- [email protected] To unsubscribe send an email to [email protected]
