Henri, Tania, Jiahui, Mission -01, posted yesterday, already answers most of this thread. The exclusion moved to 6.9, and -01 adds an adjudication object with kind human or policy, a required policy id and version for the policy case, and a governance_record boolean joined by approval_event_id to a companion governance-record draft.
Two changes would make that answer hold up. First, Jiahui is right that the reference must be typed: a standing-policy authority and a decision instance are different things, and an untyped pointer collapses them, which is the approval-reuse failure again. The adjudication kind already carries half of that distinction. Second, Henri is right that the reference must stay format-opaque, but a boolean plus an ID join forces every verifier back to the issuer. A typed digest of the signed governance record makes it checkable by any holder of the artifact. So: swap governance_record from boolean to a typed digest, keep the record format out of OAuth entirely, and any signed record format, Vaara receipts included, becomes one admissible record rather than the mechanism. Kieran On Wed, Oct 21, 2026 08:38 PM, Henri Sirkkavaara <[email protected]> wrote: > Tania, all, > > draft-sirkkavaara-vaara-receipt-14 records the standing rule and the > specific decision separately. Each decision record carries a policyDigest > over the issuer's decision state when it decided, and an approver member > that is exactly "human" or "policy", both under the issuer's signature. A > relying party that fetches the record by its digest can tell whether a > person or a standing rule approved this action, and which rule, without the > Mission carrying either. > > My answer is yes, with the reference kept opaque. One digest of a signed > decision record is enough for out-of-band provenance, and the Mission does > not need to know the record's format. It would help if 6.2 said the > reference binds to the decision that authorized this action. A digest of > the policy alone cannot show which action it approved. > > > Henri Sirkkavaara > Founder, Vaara > vaara.io | [email protected] > > Helsinki, Finland > _______________________________________________ > OAuth mailing list -- [email protected] > To unsubscribe send an email to [email protected] >
_______________________________________________ OAuth mailing list -- [email protected] To unsubscribe send an email to [email protected]
