[OAUTH-WG] Re: draft-chen-oauth-agent-authz-use-cases-01

[Blake Morrison <[e-mail]>]

Hi Meiling,

Not a co-author but adding my two cents as a reader running the same check.

I went through the requirements against the gap analysis in each use case,
using the repo md since it is ahead of -02. UC1, UC2, UC5, UC7, UC10 and UC11
all check out, and Jia Chen has UC3 and UC4.

Two dangling.

UC8, requirement 2, fine-grained permission limited to a fixed set of domains
and to DS updating only. The three gaps cover multi-hop delegation syntax,
task and bulk revocation, and the audit-id claim. None of them reaches the
scoping requirement.

UC9, requirement 3, Delegated Authorization. Neither the hierarchical
delegation to sub-provider O&M teams nor the tenant case has an entry in What
Works or in What's Missing.

One other thing on UC8. Its requirements use plain bullets rather than the
bold-label shape the other use cases use, and the What's Missing heading and
all three of its gap bullets have unclosed bold markers, so they render as
asterisks. That is also why UC8 reads as empty to anything keying on the
labels, which is how I nearly missed it myself.

I will open these as issues if you would rather track them there.

Best,
Blake


On Thursday, 13 August 2026 at 7:57 PM, Meiling Chen <[e-mail]> wrote:

> Hi usecase co-authors,
> 
> I'm writing to ask for your help with a crucial quality check as we prepare for the `-03` submission of our agent authorization draft.
> 
> Recently, we received some excellent and precise feedback from Morgan on Use Case 6 (UC6). He pointed out a significant inconsistency: a requirement had been added to the "Requirements" list, but its corresponding analysis was completely missing from the "Gap Analysis" section. This created a broken link for the reader and weakened the argument for that use case.
> 
> While I have already fixed the specific issue in UC6, this incident highlights a potential systemic risk in our document. As the draft has evolved and we've added or refined requirements, we may have inadvertently created similar inconsistencies in other use cases.
> 
> Call to Action:
> 
> To prevent this from happening again and to strengthen the overall quality of our draft, I am asking each of you to please review all use cases (or at least the ones you are most familiar with) with a specific focus on the following:
> 
> Please verify that for every single requirement listed in a use case, there is a corresponding and explicit entry or discussion in the What's Missing (The Gap) or  What Works (Partially) section for that same use case.
> 
> The goal is to ensure there are no "dangling requirements" where we state a need but fail to analyze why the existing landscape (the gap) makes it necessary.
> 
> Please try to complete your review by this Friday. If you find any discrepancies, please reply to this email thread or, even better, open an issue on our GitHub repository so we can track it formally.
> 
> Thanks for your help in ensuring the consistency and integrity of our work. This proactive check will make the document much stronger for the next round of community review.
> 
> Best regards,
> 
> Meiling
> 
> [e-mail]