Define means for Access Grant Subject to verify Access Receipt delivered in Message

[elf-pavlik]

On proposal

Specification

Details

In case of Provide Receipt in Application Registration Application can consider Access Receipt as valid since it fetches it from its Application Registration.

In case of Provide Receipt in Message it seems that message would have to be created while authenticated as Agent referenced as fromAgent.

Further direction could take advantage of digital signatures. Especially if Data Grant would be used as Credential / Capability while accessing the resource.

Acceptance criteria

• Define means for Access Grant Subject to verify Access Receipt delivered in Message

[elf-pavlik]

Apparently server-managed auxiliary resource is still up in the air solid/specification#177

During the call we decided to focus on path forward which would rely on signed Verifiable Credential

[elf-pavlik]

With discussed Authorization Notification approach this might not be needed. After receiving the notification Authorization Agent should perform Agent Registration discovery #91 which would ensure that registration was created by Social Agent that discovery was performed on.

[elf-pavlik]

As discussed during today's meeting I'll prepare PR following my last comment.