Subject: [GNAP] RO statement is not always true

From: Tom Jones <[email-masked]>
Date: Wed, 9 Dec 2020 10:17:54 -0800

That is it is often false which is why i dislike the term RO. Often the the
data about the subject was created by the RS and can be bound by law not to
delete it.
*Resource Owner (RO)*

Authorizes the request to access a protected resource from the RS to the
client. The RO may decide to remove its consent at any time.

Note : the RO may be a physical person or may represent an organization.
thx ..Tom (mobile)

---

From: Fabien Imbault <[email-masked]>
Date: Wed, 9 Dec 2020 19:34:49 +0100

Hello Tom,

Thanks for the feedback.

Yes that's true, but keeping the data is a distinct issue from consenting
access (and removing access to some end-user). Except of course if we're
discussing specific actions, such as a delete.
When created by the RS, the RO merely represents a role of the RS.
So overall, even if your comment is spot on, the definition itself doesn't
prevent what you're describing.

What alternative would you propose that would explain it better ? (but of
course if we change a commonly used vocabulary, there's a lot more
convincing to do).

Best
Fabien

On Wed, Dec 9, 2020 at 7:18 PM Tom Jones <[email-masked]>
wrote:

> That is it is often false which is why i dislike the term RO. Often the
> the data about the subject was created by the RS and can be bound by law
> not to delete it.
> *Resource Owner (RO)*
>
> --
> TXAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/txauth
>

---

From: Tom Jones <[email-masked]>
Date: Wed, 9 Dec 2020 10:43:58 -0800

you could delete the sentence that is false.  The RO may decide to remove
its consent at any time.

Perhaps you could say that The RO may be given a method to tell the AS to
remove its consent.

the way it is written the AS MUST have such an API. -->. or was that your
intention?
In any case such a statement belongs in a normative section NOT IN THE
TAXONOMY!!!

Peace ..tom

---

From: Fabien Imbault <[email-masked]>
Date: Wed, 9 Dec 2020 19:57:43 +0100

The intent was not to make it mandatory, but you're right, it becomes a
consequence. The intent was to remind end-users that the RO is in control
of its consent decisions.

Your alternative proposal looks fine to me.

Thanks for spotting that.
Fabien

Le mer. 9 déc. 2020 à 19:44, Tom Jones <[email-masked]> a
écrit :

>> So overall, even if your comment is spot on, the definition itself
>> doesn't prevent what you're describing.
>>