[OAUTH-WG] Re：Re: Call for interest: fine-grained authorization in OAuth (IETF 126 follow-up)

[Blake Morrison <[e-mail]>]

Hi Dapeng,

Thanks. I'll write the requirement up on Karl's #939 since his Mission
Request Provenance draft already covers most of it.

In -01 the signed evidence is displayed_content, which is the agent's
reading as the user confirmed it. The instruction it was read from
isn't in the evidence. semantic_expansion_level is the only field that
speaks to the distance between them and 3.6 leaves audit_trail outside
the AS signature, meaning nothing signed backs the level up. A digest
of the instruction in user_confirmation, or a reference to a provenance
assertion over it, would give the level something to be checked
against.

Blake