> Karl, all, > > Karl's point that linking a Mission's approval to a later action > requires separate action evidence is the part I work on. > draft-yossif-psea defines that evidence as an EAT profile: the > approver's enrolled authenticator signs, after user verification, over > the SHA-256 of the RFC 8785 canonical parameters of one specific > action. That is the decision-instance level Jiahui separated from > standing authority, made by a person rather than a rule. > > It fits the shape Kieran and Henri converged on. A Mission or Mandate > would carry a typed digest of the token, and the token format stays > out of OAuth. One independent verifier, posted to RATS, reproduces the > published conformance results for -03. > > If the provenance members end up with a typed reference for per-action > evidence, I'm happy to check that a PSEA token fits it. > > Mohamad
_______________________________________________ OAuth mailing list -- [email protected] To unsubscribe send an email to [email protected]
