[OAUTH-WG] Re: New Version Notification for draft-chen-oauth-agent-authz-use-cases-02.txt

[Meiling Chen <[e-mail]>]

Hi Mohamad,
Thank you for your email. First and foremost, please accept my sincere apologies for the conflicting guidance and the confusion this has caused. You were absolutely right to flag the contradictory instructions, and I appreciate you asking for a clear direction before proceeding.
After you pointed this out, I went back and reviewed Yuning's recent, detailed comments on Issue #15 and the corresponding updates to Use Case 1.
I now agree completely with your and Yuning's assessment. The approach to enhance UC1 is the correct one, and we do not need a new standalone use case for this. The updated text, which covers the three points Yuning listed (binding constraints, preserving admission basis, and verifying evidence), appears to address the core requirements you outlined.
The crucial next step is to ensure this solution works for you. Could you please review the latest version of the UC1 text and confirm that it fully resolves the issue from your perspective?
In particular, we want to be sure it meets the excellent point you raised: does the text make it clear that this is a failure where "the agent had authority and the specific action was never approved by anyone"? Your confirmation on this would be invaluable before we close the issue.
Thank you again for your diligence and for pushing for clarity. It's greatly appreciated, and I'm sorry for the detour.
Best,
Meiling


[e-mail]
 
From: Mohamad Khalil Yossif
Date: 2026-08-12 21:09
To: chenmeiling
CC: oauth
Subject: Re: [OAUTH-WG] New Version Notification for draft-chen-oauth-agent-authz-use-cases-02.txt

Meiling, Yuning,

Before I open a PR I need one thing settled, because the two answers
I have point in opposite directions and whichever I build will
conflict with the other.

Yuning wrote on #15 yesterday that the scenario is better handled
inside UC1, that UC1 has already been updated to cover it, and that
#15 can be closed as merged.

Meiling wrote this morning that a new standalone use case is the
clearest approach, and asked me to open a PR in that shape.

I am happy to write either. Tell me which and I will send it.

For what it is worth, my own view sits closer to Yuning's, and I want
to say why in case it helps you decide rather than just defer.

The three points Yuning added to UC1 are the right ones - binding
approved constraints to later execution, preserving the admission
basis through to the endpoint, and verifying execution-time evidence
before the action takes effect. Those cover the gap. If they are in
UC1 already, a separate use case would restate the same requirements
under a different narrative, and the catalogue gets longer without
getting clearer.

The one thing I would check before closing #15 is whether the UC1
text keeps the distinction visible. The failure is not that the
agent lacked authority, and not that the wrong principal acted. The
agent had authority and the specific action was never approved by
anyone. If UC1 now carries that as a stated requirement rather than
as narrative context, then #15 is genuinely covered and I have no
objection to closing it.

If instead you want it standalone because the point gets lost inside
UC1, that is a reason I would accept, and I will write it that way.

On Gap C, the enrollment dependency, Yuning is right that it is
cross-cutting rather than UC1-specific. It sits under every use case
in the catalogue where a key is resolved to a person. If it is
useful I can propose short text for it as a cross-cutting concern
rather than attached to any single use case.

Mohamad