[OAUTH-WG] Re: Call for interest: fine-grained authorization in OAuth (IETF 126 follow-up)

[Iman Schrock <[e-mail]>]

Hi Mohamad,

Yes. Our Gate tests cover the executor side: a signed receipt covers a $400
USD payout to acct_x. Changing the amount to $9,999.99 is refused before
any provider call:
https://github.com/emiliaprotocol/emilia-protocol/blob/62a4310b82af658cbfb0ec1c83f8405ed3eb3bfe/packages/gate/adapters/stripe.test.js#L71

That test uses synthetic signoffs and a mock Stripe provider. It does not
establish human user verification.

Our individual AE-CHALLENGE -07 draft
<https://www.ietf.org/archive/id/draft-schrock-ae-challenge-07.html#section-1.1>
describes requesting evidence for a resource-derived action and naming
acceptable presentation profiles. Section 1.1 keeps native OAuth
transaction authorization separate rather than replacing it.

Could we use the unchanged approval followed by an amount mutation as a
shared PSEA negative case, checking the binding through to dispatch? We
haven't demonstrated PSEA interoperability yet.

Best,
Iman


On Wed, 14 Oct 2026 18:28:52 +0300, Mohamad Khalil Yossif <mohamad=
[e-mail]> wrote:

> Dapeng, all, > > Yes to the direction. One question about where item 2
ends. > > For most requests the negotiation ends in a token with the right
> fine-grained authority. For a high-consequence action the resource >
server may need more: an approval of the exact parameters, by the > person,
at the moment it runs. RFC 9470 lets the resource server ask > for stronger
authentication, but not for that. Karl's Action-Bound > Approval section in
draft-mcguinness-mission-runtime describes the > gate and leaves open how
the approval is obtained. > > I've been working on one way to produce that
evidence: a signature > on the user's own authenticator, gated by user
verification, over a > canonical digest of the parameters
(draft-yossif-psea-03, one > independent verifier so far). > > Is anyone
else hitting this case: a valid token, the right scope, > and still a need
to show that a person approved this specific > action? If so, it seems
worth having the negotiation give the > resource server a defined way to
ask for it. > > Mohamad