[Audit] Re: Charter Comments -- more specific on the scope?

[Sumit Ahuja <[e-mail]>]

Lars, Iman, all,

Thank you, Lars. This goes into the -00 as Case 9, just like Iman put it.

Lars will be named as a contributor for this case.

Sumit P. Ahuja
Main Labs

On Sun, Oct 11, 2026 12:23 PM, Iman Schrock <[e-mail]> wrote:
> Hi Lars,
> 
> The revocation example is useful. I'd keep the refusal decision
> separate from the evidence explaining its cause.
> 
> An authenticated, action-bound DENY from the authorized decider can
> fill a slot that asks whether the action was refused. Where the
> declaration also requires grounds, a single DENY cannot tell us
> whether revocation was established or the status check could not
> finish. That grounds requirement remains incomplete, even though the
> refusal decision is present.
> 
> Could we frame the case that way? It captures the gap you identified
> without making every refusal record globally ineligible. The record
> should name the unavailable input when the check could not finish, as
> you suggest. Neither case clears an earlier unresolved dispatch.
> 
> Best,
> Iman
> 
> 
> On Sun, 11 Oct 2026 16:06:59 +0200, Lars Kersten Kroehl
> <lars=[e-mail] <mailto:[e-mail]>> wrote:
> > Sumit, a case for the list, written in the shape of the others. Renumber it as needed.
> >
> > Refusal with an undetermined cause.
> > The slot is filled by a record that states whether a refusal came from a check that ran and failed, or from a check that could not be completed. A record carrying only a terminal verdict leaves the slot empty, because a reader cannot tell a control that held from a control that was never reached. Where the cause is a check that could not be completed, the record names the input that was unavailable. The two causes are reported under distinct values; a record that collapses them into one refusal value is reported as incomplete.
> >
> > Example: an action is refused because the issuer's revocation status could not be retrieved within the relying party's time limit. The record says that the revocation check was not completed and names the status source. The value it reports differs from the value used for a credential that was found to be revoked.
> >
> > Disclosure: AAE as published collapses both causes into a single DENY, so this case describes a gap in my own specification as much as anywhere else. I am carrying it into the next revision.
> >
> > Lars