Review OAuth2/delegated scopes

1. 01

   Concepts & system design

   60 min· read · map the mechanismtimer

   R22 — RFC 9700 OAuth Security BCP

   R23 — RFC 8693 Token Exchange

   Read the assigned sections; map the mechanism, threat model and trade-offs.

2. 02

   Project implementation

   120 min· build · integrate · debugtimer

   Audit D7 OAuth2 delegated scopes, resource aud binding, short TTL expiry, revocation lists, parameter-bound human approvals, and confused-deputy protections across all P3 workflows (including C4 PR proposals and C6 computer-use actions).

   Build, integrate, debug and improve the increment in the active project.

3. 03

   Security lab

   60 min· attack your own systemtimer

   Run privilege-escalation, cross-resource token reuse, expired-token, and TOCTOU approval-tampering attacks.

   Test the abuse case, failure path, authorization bypass or resource limit.

4. 04

   Verification & evidence

   30 min· test · record evidencetimer

   Complete D7 delegation and approval security verification report.

   Add or run regression tests; record the 9-point evidence record.

5. 05

   Deliberate practice & Socratic review

   30 min· explain aloud · update gapstimer

   Answer the 8 Socratic questions without notes: What? Why? How? What if? Why not? How can I prove it? Where can it break? What have I learned?

   Re-explain the hardest concept aloud, inspect one edge case, update the gap log.

6. total5 h

• R22OAuth 2.0 Security BCP (RFC 9700)↗ rfc-editor.org

  RFC 6749 core flows + RFC 9700 security best practices: narrow scopes, audience restriction, token leakage, and replay.

• R23OAuth 2.0 Token Exchange (RFC 8693)↗ rfc-editor.org

  Delegated authorization patterns, sub (subject) vs. act (actor) claims for agent delegation.

Read only the named sections needed for today's task. Reading sits inside the 60-minute concepts block; it is not extra time.

• docsRFC Editor
  RFC 9700: Best Current Practice for OAuth 2.0 Security

  The normative source for exact redirect URI matching, mandatory PKCE, audience restriction, token replay and refresh-token rotation, which are the D7 controls you are auditing across every P3 workflow.

  R22checked 2026-11-11
• videoEnterprise Security Architecture
  OAuth Security Best Practices: RFC 9700 Explained, Rule by Rule

  Walks RFC 9700 clause by clause into a threat register, which maps directly onto the confused-deputy and token-leakage checks for the delegated agent broker.

  R22checked 2026-11-11
• videoSascha Preibisch
  OAuth 2.0 - Token Exchange

  Shows how RFC 8693 exchanges one token for a narrower, audience-bound token, which is the mechanism behind sub/act delegation and short-TTL downscoping in D7.

  R23checked 2026-11-11
• articleoauth.net
  OAuth 2.0 Security Best Current Practice — RFC 9700

  Summarizes who the BCP applies to (clients, authorization servers, resource servers) and the new attack classes it covers, useful for deciding which D7 component owns each mitigation.

  R22checked 2026-11-11
• labKeycloak
  Configuring and using token exchange

  A runnable delegated-token lab: subject tokens, requested subjects, audience filtering and permission checks, so you can actually exercise act-claim delegation and revocation instead of only reading about it.

  R23checked 2026-11-11

A lab is complete only when it produces evidence. Installing PyRIT, Garak, Presidio or TransformerLens is not completion. Saved on this device only.