[GNAP] When are HRPCs normative in an IETF protocol?

[Adrian Gropper <[e-mail]>]

I'm new to HRPC but convinced that the work here is both relevant and
unique in my experience with standards groups. My background is in
software-intensive medical devices and health records. I am a volunteer CTO
for the Patient Privacy Rights Foundation and lead a related,
non-commercial open source example implementation of standards-based health
information access.

IETF GNAP is a new delegated authorization protocol intended to replace
OAuth in many use-cases, including Alice-to-Bob cases. In the HRPC context,
delegated authorization presents the risk of forced association as a
violation of human rights.

In particular, forced association between a data subject's service provider
as a resource server and an authorization service provider that is a
delegate of the service provider leads to hyperscale platforms in social
media, document creation, and other forms of information exchange,
including health records.

The issue at hand is how should GNAP mitigate the unintended consequences
of forced association and when should the mitigations be normative in the
overall IETF context.

Here's a Gdoc with the current state of the discussion in GNAP including a
potential PR:

https://docs.google.com/document/d/1C_OEt2GeXfMLJJentmk7eX3A8gtq0_zYDfhW3AEwiSQ/edit?usp=sharing


If GNAP is a good test case for HRPC, please help me improve the PR and
introduce whatever process is appropriate to determine when HRPCs are
normative in a protocol. (Please suggest where to move the Gdoc to a more
suitable place for discussion.)

-Adrian