[GNAP] Human Rights Protocol Considerations applied to GNAP

[Adrian Gropper <[e-mail]>]

The GNAP protocol risks creating a forced association per HRPC.

A draft PR is at
https://deploy-preview-434--gnap-core-protocol-editors-draft.netlify.app/draft-ietf-gnap-core-protocol#section-13
(This
PR was closed in the core spec pending a potential move to the resource
server spec as discussed in [4].)

Here's what I'm hoping is discussed between the GNAP review of the Human
Rights Considerations PR on Thursday and the HRPC Discussion on Friday:

1 - The HRPC Abstract explicitly addresses "forced association" [1]
2 - GNAP is primarily a delegated authorization protocol [2]
3 - Delegation can be to the clients, authorization servers, and end-users
roles in GNAP.
4 - Forced association with a delegate might be a human rights issue.
5 - A PR was submitted that discusses the human rights issue, referencing
HRPC, as well as mitigations [3]
6 - The PR and subsequent comments describe three possible mitigations [4]
7 - Antecedent authorization protocols, such as OAuth, that force
association have led to unintended platform network effects.
8 - Guidance from HRPC is sought as to the process by which (GNAP / IETF?)
decides if the mitigations are to be a SHOULD?

[1] https://datatracker.ietf.org/meeting/115/agenda/hrpc-drafts.pdf
[2] https://datatracker.ietf.org/meeting/115/agenda/gnap-drafts.pdf
[3[ https://github.com/ietf-wg-gnap/gnap-core-protocol/pull/434
[4] https://github.com/ietf-wg-gnap/gnap-resource-servers/issues/54

The PR will be discussed in GNAP on Thursday Session 1.
The HRPC discussion is on Friday Session 1.
I hope many will participate in both sessions.

- Adrian