captured core.consent-page

Ask the user to approve a client's access

/oauth/authorize sends a signed-in user here when no stored consent covers the request, when the client is an AI agent, which never skips the screen, or when prompt=consent asks for the screen. An operator-flagged first-party client (ADR-017 Decision 9) needs no stored consent there: its administrative consent covers its scopes, so it is sent here only for a dangerous scope or prompt=consent. The GET checks the client and its redirect URI again, refuses a QAuth API audience the client does not list, binds the scopes and resource indicators it is about to show to the session, and renders a page with a CSRF value; for an agent client the page also names it as an AI agent and says how long it may keep working. The POST checks that value, burns it, checks the client again and acts on the decision: deny sends access_denied back to the client; allow refuses a scope above the agent cap, a scope or resource set other than the one the page showed, and a sign-in too old for what is asked (for a native_backend client, any sign-in older than two minutes), then saves the consent when the user ticked "Remember this decision", mints an authorization code and sends it back.

What this view shows

GET and POST /ui/consent from the request to the response, in the order the server runs its checks.

Open world: what is not drawn here is not ruled out. Only the guarantees below are binding.

Left out of this view:

the consent skip: /oauth/authorize decides it (canSkipConsent), and sends a request here only when no stored consent covers it, the client is an agent, or prompt=consent asks for the screen; an agent never skips the screen (ADR-015 Decision 11), so prompt=none from one answers consent_required there and never reaches this flow
the administrative consent (ADR-017 Decision 9, #633): /oauth/authorize skips the screen for a client whose operator-set first-party profile resolves (resolveFirstPartyProfile) when no requested scope is dangerous and prompt is not consent, writes no consent, and records consent.administrative with the code; a dangerous scope or prompt=consent sends such a client here, where the screen runs as for any client. A native_backend client's request asks for a fresh sign-in there as prompt=login does, whatever it says (its own prompt=consent still sends it here), and prompt=none from one answers login_required there
revoking a consent (/consents, /api/consents), which is its own flow: ACC-11 moves it to the account console and writes its graph
a store failure before anything is written (the lookup of the host, the rate-limit counter, the session, the side record, the client) answers 500, and so does a failure to end the session of a disabled user; a failure to record the event of a refusal (request.csrf_rejected, consent.denied, step_up.required) turns that refusal into a 500
Fastify's own answers before the schema check: a POST body of a media type no parser takes is refused with 415; a JSON body is parsed and checked like the form, and takes the same flow
the causes of a 421 (a malformed or unknown host, a disabled realm, a realm with no issuer, an endpoint host) give one answer and are drawn as one exit
with RATE_LIMIT_ENABLED=false neither rate limit is applied
when the pending-authorization store is down, the login redirect carries the authorize URL itself in return_to instead of a handle
staging reads as production in every check drawn here; environment names the effective environment, the stricter of the client's and its realm's ceiling
the effects are not one transaction: a failure after the consent is saved leaves it saved, and a failure to record the grant leaves the code minted, though the client never receives it
the POST does not check the QAuth API audiences again: it grants the resources a GET of the session bound, and that GET refused an unlisted one; an operator who changes the client's audience between the two requests is not drawn, and /oauth/token refuses the code then
a client whose is_agent changes between the GET and the POST (a CIMD document that changed) is not drawn: clientIsAgent holds for both requests. The POST compares it with what the GET bound, grants nothing when they differ, and sends the browser to /oauth/authorize again, which shows the page the client needs now (#845)

The main story

When: The host is the primary host of an enabled realm, the address is under its limit, the query or form passes the route schema, and the request carries a live browser session of an enabled user, the authorization request, rebuilt for a sign-in redirect, is at most 16 KiB, client_id names a usable client, redirect_uri is one of its registered URIs that the environment permits, and dpop_jkt is absent, unread (DPoP off) or one base64url SHA-256 thumbprint, the scope parameter names no agent:* scope above the agent mode cap the operator set for the client, the resource indicators name no QAuth API audience (urn:qauth:aud:) that the client's own audience does not list, the client is not an agent: its is_agent is false, the client resolves to the production or staging profile, the posted csrf_token is the session's live value, the user pressed Allow, the posted scope, filtered by the client's allowlist, is the set the session bound for this client, and the posted resource fields name the bound resources, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, allow_forever is 1, as the ticked "Remember this decision" box sends it.

Wait for a consent request: GET /ui/consent arrives, with the parameters of /oauth/authorize
Find the realm of the host: the request has its realm
Count the request against the global limit: the address is under its limit
Check the query against the authorize schema: the query matches the schema
Find the browser session: the session is live
Find the client: the client is enabled and not suspended
Check the redirect URI against the client and its environment: the redirect URI is registered and permitted
Read the DPoP key the code is to be bound to: dpop_jkt is absent, unread or well formed
Refuse an agent scope above the client's cap: no agent scope is above the cap
Describe the client from the server's own records: the client is described; the scopes to show are the requested ones the client's allowlist holds
Refuse a QAuth API audience the client does not list: every QAuth API audience among the resources is one the client lists
Bind the shown scopes and resources, and the CSRF value, to the session: the binding is written
Show the consent page: the user presses Allow or Deny, and the browser posts the form
Find the realm of the host: the request has its realm
Count the request against the authorize limit: the address is under its limit
Check the form against the consent form schema: the form matches the schema
Find the browser session: the session is live
Check the CSRF value against the session's: the values are equal
Burn the CSRF value: the value is burned
Find the client again: the client is enabled and not suspended
Check the redirect URI against the client and its environment again: the redirect URI is registered and permitted
Read the DPoP key from the form: dpop_jkt is absent, unread or well formed
Read the decision: the user pressed Allow
Refuse an agent scope above the client's cap, where the code is minted: no agent scope is above the cap
Grant only the scopes the page showed: the posted scopes are the shown ones
Grant only the resources the page named: the posted resources are the named ones
Ask for a fresh sign-in when the grant needs one: the sign-in is fresh enough, and the user ticked "Remember this decision"
Save the consent: the consent is saved
Mint the authorization code: the code is stored
Record the grant: the events are recorded

Result: Send the authorization code to the client.

The flow

Show failure paths and “the user closes the page”

blue line: the main storyred dashed line: a failure path (shown with “Show failure paths”)dotted line: decided by a rule, nobody actsdashed grey box: the server decides, nothing is showngreen exit: successred exit: no redirect

What each step answers

Step	The outside world sees
Show the consent page rendered	200 · headers: {"Content-Type":"text/html; charset=utf-8","Cache-Control":"no-store","Content-Security-Policy":"the global policy, whose style-src carries this response's nonce; for a development client \"default-src 'self'; base-uri 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; connect-src 'self'; form-action 'self'; object-src 'none'; frame-ancestors 'none'\""} · body: {"form":{"method":"post","action":"/ui/consent","fields":{"csrf_token":"the session's CSRF value (hidden)","allow_forever":"1, ticked by default","decision":"deny or allow, the two submit buttons","client_id":"the request's (hidden)","redirect_uri":"the request's (hidden)","scope":"the scopes the page lists, joined by spaces (hidden)","resource":"one hidden field per resource indicator","state":"the request's, when it has one (hidden)","nonce":"the request's, when it has one (hidden)","code_challenge":"the request's (hidden)","code_challenge_method":"S256 (hidden)","response_type":"code (hidden)","prompt":"the request's, when it has one (hidden)","max_age":"the request's, when it has one (hidden)","dpop_jkt":"the bound key, while DPoP is on and the request named one (hidden)"}}}
Show the consent page for an AI agent renderedForAgent	200 · headers: {"Content-Type":"text/html; charset=utf-8","Cache-Control":"no-store","Content-Security-Policy":"as for rendered"} · body: {"agentLine":"\"This app is an AI agent.\"","persistenceLine":"\"It may keep working until you revoke it.\" when the realm sets no sso_max_lifespan; when it sets one, \"It may keep working until you revoke it, or until <the limit, an exact duration such as 1 hour or 1 day and 12 hours> after you signed in, whichever comes first.\"","form":"the same form as rendered"}
Send the authorization code to the client code_issued	302 · headers: {"Location":"redirect_uri with code (43 base64url characters), state when the form had one, and iss"}
Tell the client the user denied the request access_denied.user_denied	302 · headers: {"Location":"redirect_uri with error=access_denied, error_description=User denied the authorization request., state when the form had one, and iss"}
Tell the client an agent scope is above its cap invalid_scope.agent_scope_mode_exceeded	302 · headers: {"Location":"redirect_uri with error=invalid_scope, error_description=requested scope exceeds the agent scope mode for this client, state when the request had one, and iss"}
Show, rather than redirect, the agent-cap error of a client no operator provisioned invalid_scope.agent_scope_mode_exceeded_shown	400 · headers: {"Content-Type":"text/html; charset=utf-8","Cache-Control":"no-store"} · body: a page titled "Sign-in not completed" that names the error invalid_scope with its description and the host of redirect_uri, and, for an http(s) redirect URI, a link "Continue to <host>" carrying the whole error response
Refuse a scope set the page did not show invalid_scope.consent_scope_mismatch	302 · headers: {"Location":"redirect_uri with error=invalid_scope, error_description=consent scope does not match the rendered authorization request, state when the form had one, and iss"}
Refuse a resource set the page did not name invalid_target.consent_resource_mismatch	302 · headers: {"Location":"redirect_uri with error=invalid_target, error_description=consent resource does not match the rendered authorization request, state when the form had one, and iss"}
Tell the client it named a QAuth API audience it does not list invalid_target.unlisted_reserved_audience	302 · headers: {"Location":"redirect_uri with error=invalid_target, error_description=a QAuth API audience is issued only to a client that lists it, state when the request had one, and iss"}
Show, rather than redirect, the unlisted-audience error of a client no operator provisioned invalid_target.unlisted_reserved_audience_shown	400 · headers: {"Content-Type":"text/html; charset=utf-8","Cache-Control":"no-store"} · body: a page titled "Sign-in not completed" that names the error invalid_target with its description and the host of redirect_uri, and, for an http(s) redirect URI, a link "Continue to <host>" carrying the whole error response
Send the browser to sign in, then back to the authorization request sign_in_required.no_session	302 · headers: {"Location":"/ui/login?return_to=%2Fui%2Fresume%2F<handle>, the handle 43 base64url characters"}
Clear the stale session cookie and send the browser to sign in sign_in_required.stale_session	302 · headers: {"Set-Cookie":"__Host-qauth_session=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0, with Secure when SESSION_COOKIE_SECURE is on","Location":"/ui/login?return_to=%2Fui%2Fresume%2F<handle>"}
End the session of a disabled or deleted user and send the browser to sign in sign_in_required.account_disabled	302 · headers: {"Set-Cookie":"__Host-qauth_session=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0, with Secure when SESSION_COOKIE_SECURE is on","Location":"/ui/login?return_to=%2Fui%2Fresume%2F<handle>"}
Send the browser to sign in again before the grant sign_in_required.fresh_login	302 · headers: {"Location":"/ui/login?return_to=%2Fui%2Fresume%2F<handle>"}
Refuse a request too large to park for the sign-in invalid_request.authorization_too_large	400 · body: {"type":"https://docs.qauth.dev/reference/problem-types/#invalid-request","title":"Invalid request","status":400,"detail":"authorization request is too large","instance":"/ui/consent","code":"invalid_request","trace_id":"the request id"}
Refuse a form whose CSRF value is not the session's invalid_csrf_token.mismatch	400 · body: {"type":"https://docs.qauth.dev/reference/problem-types/#invalid-csrf-token","title":"Invalid CSRF token","status":400,"detail":"The CSRF token is missing or does not match the session","instance":"/ui/consent","code":"invalid_csrf_token","trace_id":"the request id"}
Refuse a client_id that names no client invalid_request.unknown_client	400 · body: {"type":"https://docs.qauth.dev/reference/problem-types/#invalid-request","title":"Invalid request","status":400,"detail":"client_id does not name a client of this realm","instance":"/ui/consent","code":"invalid_request","trace_id":"the request id"}
Refuse a client that is disabled or suspended unauthorized_client.disabled	400 · body: {"type":"https://docs.qauth.dev/reference/problem-types/#unauthorized-client","title":"Unauthorized client","status":400,"detail":"client is disabled","instance":"/ui/consent","code":"unauthorized_client","trace_id":"the request id"}
Refuse a redirect URI the client did not register invalid_request.redirect_uri_not_registered	400 · body: {"type":"https://docs.qauth.dev/reference/problem-types/#invalid-request","title":"Invalid request","status":400,"detail":"redirect_uri not registered","instance":"/ui/consent","code":"invalid_request","trace_id":"the request id"}
Refuse a registered redirect URI that no environment permits invalid_request.redirect_uri_not_permitted	400 · body: {"type":"https://docs.qauth.dev/reference/problem-types/#invalid-request","title":"Invalid request","status":400,"detail":"redirect_uri not permitted for this environment","instance":"/ui/consent","code":"invalid_request","trace_id":"the request id"}
Refuse a dpop_jkt that is not a key thumbprint invalid_request.malformed_dpop_jkt	400 · body: {"type":"https://docs.qauth.dev/reference/problem-types/#invalid-request","title":"Invalid request","status":400,"detail":"dpop_jkt must be the base64url SHA-256 JWK thumbprint of a DPoP key","instance":"/ui/consent","code":"invalid_request","trace_id":"the request id"}
Refuse a redirect URI the screen cannot show invalid_request.redirect_uri_not_shown	400 · body: {"type":"https://docs.qauth.dev/reference/problem-types/#invalid-request","title":"Invalid request","status":400,"detail":"redirect_uri cannot be shown","instance":"/ui/consent","code":"invalid_request","trace_id":"the request id"}
Refuse a query that does not match the authorize schema validation_error.query	400 · body: {"type":"https://docs.qauth.dev/reference/problem-types/#validation-error","title":"Validation error","status":400,"detail":"The request is not valid.","instance":"/ui/consent","code":"validation_error","trace_id":"the request id","errors":[{"pointer":"/<the parameter>, such as /code_challenge","message":"the schema's message"}]}
Refuse a form that does not match the consent form schema validation_error.form	400 · body: {"type":"https://docs.qauth.dev/reference/problem-types/#validation-error","title":"Validation error","status":400,"detail":"The request is not valid.","instance":"/ui/consent","code":"validation_error","trace_id":"the request id","errors":[{"pointer":"/<the field>, such as /decision","message":"the schema's message"}]}
Refuse a host that serves no browser route misdirected_request.host	421 · body: {"type":"https://docs.qauth.dev/reference/problem-types/#misdirected-request","title":"Misdirected request","status":421,"detail":"This server does not answer for the requested host","instance":"/ui/consent","code":"misdirected_request","trace_id":"the request id"}
Refuse a GET over the global limit too_many_requests.global_limit	429 · headers: {"x-ratelimit-limit":"RATE_LIMIT_MAX","x-ratelimit-remaining":"0","x-ratelimit-reset":"the seconds until the window resets","retry-after":"the same seconds"} · body: {"type":"https://docs.qauth.dev/reference/problem-types/#too-many-requests","title":"Too many requests","status":429,"detail":"Rate limit exceeded, retry in {the rest of the window, such as 1 minute}","instance":"/ui/consent","code":"too_many_requests","trace_id":"the request id"}
Refuse a POST over the authorize limit too_many_requests.authorize_limit	429 · headers: {"x-ratelimit-limit":"AUTHORIZE_RATE_LIMIT","x-ratelimit-remaining":"0","x-ratelimit-reset":"the seconds until the window resets","retry-after":"the same seconds"} · body: {"type":"https://docs.qauth.dev/reference/problem-types/#too-many-requests","title":"Too many requests","status":429,"detail":"Rate limit exceeded, retry in {the rest of the window, such as 1 minute}","instance":"/ui/consent","code":"too_many_requests","trace_id":"the request id"}
Fail on a session cookie that cannot be decoded server_error.malformed_cookie	500 · body: {"type":"https://docs.qauth.dev/reference/problem-types/#internal-error","title":"Internal error","status":500,"instance":"/ui/consent","code":"internal_error","trace_id":"the request id"}
Fail on a store error server_error.store	500 · body: {"type":"https://docs.qauth.dev/reference/problem-types/#internal-error","title":"Internal error","status":500,"instance":"/ui/consent","code":"internal_error","trace_id":"the request id"}

How it decides what happens next

Find the realm of the host

#	If	Then
1	the host names no enabled realm with an issuer	Refuse a host that serves no browser route
2	the host is one of the realm's endpoint hosts	Refuse a host that serves no browser route
3	the request has its realm	Count the request against the global limit

The first matching rule wins.

Exact conditions

#	Condition	Goes to	Situations
1	`hostUnknown`	`misdirected_request.host`	64512 of 580608
2	`endpointHost`	`misdirected_request.host`	64512 of 580608
3	otherwise	`showRateLimiting`	451584 of 580608

hostUnknown: gate == 'unknownHost'
endpointHost: gate == 'endpointHost'

Count the request against the global limit

#	If	Then
1	the address has used up its requests	Refuse a GET over the global limit
2	the address is under its limit	Check the query against the authorize schema

The first matching rule wins.

Exact conditions

#	Condition	Goes to	Situations
1	`rateLimited`	`too_many_requests.global_limit`	64512 of 451584
2	otherwise	`showValidatingQuery`	387072 of 451584

rateLimited: gate == 'rateLimited'

Check the query against the authorize schema

#	If	Then
1	the query does not match the schema	Refuse a query that does not match the authorize schema
2	the query matches the schema	Find the browser session

The first matching rule wins.

Exact conditions

#	Condition	Goes to	Situations
1	`inputInvalid`	`validation_error.query`	64512 of 387072
2	otherwise	`showFindingSession`	322560 of 387072

inputInvalid: gate == 'invalidInput'

Find the browser session

#	If	Then
1	the session cookie cannot be decoded	Fail on a session cookie that cannot be decoded
2	the request carries no session; the authorize URL is rebuilt from the query	Park the authorization request for the sign-in
3	the cookie does not verify, or names a session that has ended, and is cleared	Park the authorization request for the sign-in
4	the session's user is gone or disabled, or was disabled after the session began; the session is ended and its cookie cleared	Park the authorization request for the sign-in
5	the session is live	Find the client

The first matching rule wins.

Exact conditions

#	Condition	Goes to	Situations
1	`cookieMalformed`	`server_error.malformed_cookie`	64512 of 322560
2	`noSession`	`parkingRequest`	64512 of 322560
3	`staleSession`	`parkingRequest`	64512 of 322560
4	`accountDisabled`	`parkingRequest`	64512 of 322560
5	otherwise	`showCheckingClient`	64512 of 322560

cookieMalformed: gate == 'malformedCookie'
noSession: gate == 'noSession'
staleSession: gate == 'staleSession'
accountDisabled: gate == 'accountDisabled'

Find the client

#	If	Then
1	the client_id names no client of the realm	Refuse a client_id that names no client
2	the client is disabled or suspended	Refuse a client that is disabled or suspended
3	the client is enabled and not suspended	Check the redirect URI against the client and its environment

The first matching rule wins.

Exact conditions

#	Condition	Goes to	Situations
1	`clientUnknown`	`invalid_request.unknown_client`	9216 of 64512
2	`clientUnusable`	`unauthorized_client.disabled`	9216 of 64512
3	otherwise	`showCheckingRedirectUri`	46080 of 64512

clientUnknown: params == 'unknownClient'
clientUnusable: params == 'unusableClient'

Check the redirect URI against the client and its environment

#	If	Then
1	redirect_uri is not registered for the client	Refuse a redirect URI the client did not register
2	no environment permits that redirect_uri	Refuse a registered redirect URI that no environment permits
3	the redirect URI is registered and permitted	Read the DPoP key the code is to be bound to

The first matching rule wins.

Exact conditions

#	Condition	Goes to	Situations
1	`redirectUnregistered`	`invalid_request.redirect_uri_not_registered`	9216 of 46080
2	`redirectNotPermitted`	`invalid_request.redirect_uri_not_permitted`	9216 of 46080
3	otherwise	`showReadingDpopKey`	27648 of 46080

redirectUnregistered: params == 'unregisteredRedirect'
redirectNotPermitted: params == 'unpermittedRedirect'

Read the DPoP key the code is to be bound to

#	If	Then
1	dpop_jkt is not one thumbprint	Refuse a dpop_jkt that is not a key thumbprint
2	dpop_jkt is absent, unread or well formed	Refuse an agent scope above the client's cap

The first matching rule wins.

Exact conditions

#	Condition	Goes to	Situations
1	`dpopJktMalformed`	`invalid_request.malformed_dpop_jkt`	9216 of 27648
2	otherwise	`showCheckingAgentCap`	18432 of 27648

dpopJktMalformed: params == 'malformedDpopJkt'

Refuse an agent scope above the client's cap

#	If	Then
1	an agent scope is above the cap, for a client no operator provisioned	Show, rather than redirect, the agent-cap error of a client no operator provisioned
2	an agent scope is above the cap, for a client an operator provisioned	Tell the client an agent scope is above its cap
3	no agent scope is above the cap	Describe the client from the server's own records

The first matching rule wins.

Exact conditions

#	Condition	Goes to	Situations
1	`overAgentCapShown`	`invalid_scope.agent_scope_mode_exceeded_shown`	6144 of 18432
2	`overAgentCap`	`invalid_scope.agent_scope_mode_exceeded`	6144 of 18432
3	otherwise	`showDescribingClient`	6144 of 18432

overAgentCap: agentScope != 'withinCap'
overAgentCapShown: agentScope == 'overCapSelfService'

Describe the client from the server's own records

#	If	Then
1	the client display data cannot show where the redirect URI goes	Refuse a redirect URI the screen cannot show
2	the client is described; the scopes to show are the requested ones the client's allowlist holds	Refuse a QAuth API audience the client does not list

The first matching rule wins.

Exact conditions

#	Condition	Goes to	Situations
1	`redirectNotShown`	`invalid_request.redirect_uri_not_shown`	3072 of 6144
2	otherwise	`showCheckingAudience`	3072 of 6144

redirectNotShown: params == 'unshownRedirect'

Refuse a QAuth API audience the client does not list

#	If	Then
1	a resource names a QAuth API audience the client does not list, for a client no operator provisioned	Show, rather than redirect, the unlisted-audience error of a client no operator provisioned
2	a resource names a QAuth API audience the client does not list, for a client an operator provisioned	Tell the client it named a QAuth API audience it does not list
3	every QAuth API audience among the resources is one the client lists	Bind the shown scopes and resources, and the CSRF value, to the session

The first matching rule wins.

Exact conditions

#	Condition	Goes to	Situations
1	`audienceUnlistedShown`	`invalid_target.unlisted_reserved_audience_shown`	1024 of 3072
2	`audienceUnlisted`	`invalid_target.unlisted_reserved_audience`	1024 of 3072
3	otherwise	`bindingScopes`	1024 of 3072

audienceUnlisted: audience != 'listed'
audienceUnlistedShown: audience == 'unlistedSelfService'

Find the realm of the host

#	If	Then
1	the host names no enabled realm with an issuer	Refuse a host that serves no browser route
2	the host is one of the realm's endpoint hosts	Refuse a host that serves no browser route
3	the request has its realm	Count the request against the authorize limit

The first matching rule wins.

Exact conditions

#	Condition	Goes to	Situations
1	`hostUnknown`	`misdirected_request.host`	64512 of 580608
2	`endpointHost`	`misdirected_request.host`	64512 of 580608
3	otherwise	`submitRateLimiting`	451584 of 580608

hostUnknown: gate == 'unknownHost'
endpointHost: gate == 'endpointHost'

Count the request against the authorize limit

#	If	Then
1	the address has used up its authorize requests	Refuse a POST over the authorize limit
2	the address is under its limit	Check the form against the consent form schema

The first matching rule wins.

Exact conditions

#	Condition	Goes to	Situations
1	`rateLimited`	`too_many_requests.authorize_limit`	64512 of 451584
2	otherwise	`submitValidatingForm`	387072 of 451584

rateLimited: gate == 'rateLimited'

Check the form against the consent form schema

#	If	Then
1	the form does not match the schema	Refuse a form that does not match the consent form schema
2	the form matches the schema	Find the browser session

The first matching rule wins.

Exact conditions

#	Condition	Goes to	Situations
1	`inputInvalid`	`validation_error.form`	64512 of 387072
2	otherwise	`submitFindingSession`	322560 of 387072

inputInvalid: gate == 'invalidInput'

Find the browser session

#	If	Then
1	the session cookie cannot be decoded	Fail on a session cookie that cannot be decoded
2	the request carries no session; the authorize URL is rebuilt from the form	Park the authorization request for the sign-in
3	the cookie does not verify, or names a session that has ended, and is cleared	Park the authorization request for the sign-in
4	the session's user is gone or disabled, or was disabled after the session began; the session is ended and its cookie cleared	Park the authorization request for the sign-in
5	the session is live	Check the CSRF value against the session's

The first matching rule wins.

Exact conditions

#	Condition	Goes to	Situations
1	`cookieMalformed`	`server_error.malformed_cookie`	64512 of 322560
2	`noSession`	`parkingRequest`	64512 of 322560
3	`staleSession`	`parkingRequest`	64512 of 322560
4	`accountDisabled`	`parkingRequest`	64512 of 322560
5	otherwise	`checkingCsrf`	64512 of 322560

cookieMalformed: gate == 'malformedCookie'
noSession: gate == 'noSession'
staleSession: gate == 'staleSession'
accountDisabled: gate == 'accountDisabled'

Check the CSRF value against the session's

#	If	Then
1	the posted value is not the session's live one	Refuse a form whose CSRF value is not the session's
2	the values are equal	Burn the CSRF value

The first matching rule wins.

Exact conditions

#	Condition	Goes to	Situations
1	`csrfWrong`	`invalid_csrf_token.mismatch`	32256 of 64512
2	otherwise	`burningCsrf`	32256 of 64512

csrfWrong: csrf == 'wrong'

Find the client again

#	If	Then
1	the client_id names no client of the realm	Refuse a client_id that names no client
2	the client is disabled or suspended	Refuse a client that is disabled or suspended
3	the client is enabled and not suspended	Check the redirect URI against the client and its environment again

The first matching rule wins.

Exact conditions

#	Condition	Goes to	Situations
1	`clientUnknown`	`invalid_request.unknown_client`	4608 of 32256
2	`clientUnusable`	`unauthorized_client.disabled`	4608 of 32256
3	otherwise	`submitCheckingRedirectUri`	23040 of 32256

clientUnknown: params == 'unknownClient'
clientUnusable: params == 'unusableClient'

Check the redirect URI against the client and its environment again

#	If	Then
1	redirect_uri is not registered for the client	Refuse a redirect URI the client did not register
2	no environment permits that redirect_uri	Refuse a registered redirect URI that no environment permits
3	the redirect URI is registered and permitted	Read the DPoP key from the form

The first matching rule wins.

Exact conditions

#	Condition	Goes to	Situations
1	`redirectUnregistered`	`invalid_request.redirect_uri_not_registered`	4608 of 23040
2	`redirectNotPermitted`	`invalid_request.redirect_uri_not_permitted`	4608 of 23040
3	otherwise	`submitReadingDpopKey`	13824 of 23040

redirectUnregistered: params == 'unregisteredRedirect'
redirectNotPermitted: params == 'unpermittedRedirect'

Read the DPoP key from the form

#	If	Then
1	dpop_jkt is not one thumbprint	Refuse a dpop_jkt that is not a key thumbprint
2	dpop_jkt is absent, unread or well formed	Read the decision

The first matching rule wins.

Exact conditions

#	Condition	Goes to	Situations
1	`dpopJktMalformed`	`invalid_request.malformed_dpop_jkt`	4608 of 13824
2	otherwise	`readingDecision`	9216 of 13824

dpopJktMalformed: params == 'malformedDpopJkt'

Read the decision

#	If	Then
1	the user pressed Deny; consent.denied is recorded	Tell the client the user denied the request
2	the user pressed Allow	Refuse an agent scope above the client's cap, where the code is minted

The first matching rule wins.

Exact conditions

#	Condition	Goes to	Situations
1	`denied`	`access_denied.user_denied`	4608 of 9216
2	otherwise	`submitCheckingAgentCap`	4608 of 9216

denied: decision == 'deny'

Refuse an agent scope above the client's cap, where the code is minted

#	If	Then
1	an agent scope is above the cap; consent.denied is recorded	Tell the client an agent scope is above its cap
2	no agent scope is above the cap	Grant only the scopes the page showed

The first matching rule wins.

Exact conditions

#	Condition	Goes to	Situations
1	`overAgentCap`	`invalid_scope.agent_scope_mode_exceeded`	3072 of 4608
2	otherwise	`checkingScopeBinding`	1536 of 4608

overAgentCap: agentScope != 'withinCap'

Grant only the scopes the page showed

#	If	Then
1	the session holds no scope set for this client; consent.denied is recorded	Refuse a scope set the page did not show
2	the posted scopes are not the ones the page showed; consent.denied is recorded	Refuse a scope set the page did not show
3	the posted scopes are the shown ones	Grant only the resources the page named

The first matching rule wins.

Exact conditions

#	Condition	Goes to	Situations
1	`scopesUnbound`	`invalid_scope.consent_scope_mismatch`	384 of 1536
2	`scopesDiffer`	`invalid_scope.consent_scope_mismatch`	384 of 1536
3	otherwise	`checkingResourceBinding`	768 of 1536

scopesUnbound: posted == 'unboundScopes'
scopesDiffer: posted == 'otherScopes'

Grant only the resources the page named

#	If	Then
1	the posted resources are not the ones the page named; consent.denied is recorded	Refuse a resource set the page did not name
2	the posted resources are the named ones	Ask for a fresh sign-in when the grant needs one

The first matching rule wins.

Exact conditions

#	Condition	Goes to	Situations
1	`resourcesDiffer`	`invalid_target.consent_resource_mismatch`	384 of 768
2	otherwise	`checkingStepUp`	384 of 768

resourcesDiffer: posted == 'otherResources'

Ask for a fresh sign-in when the grant needs one

#	If	Then
1	the sign-in is too old for what is asked; step_up.required is recorded	Park the authorization request for the sign-in
2	the sign-in is fresh enough, and the user ticked "Remember this decision"	Save the consent
3	the sign-in is fresh enough, and the approval is for this request only	Mint the authorization code

The first matching rule wins.

Exact conditions

#	Condition	Goes to	Situations
1	`needsFreshLogin`	`parkingRequest`	240 of 384
2	`remember`	`savingConsent`	72 of 384
3	otherwise	`mintingCode`	72 of 384

needsFreshLogin: stepUp in ['promptLogin', 'maxAgeExceeded'] or (stepUp == 'dangerousScope' and not developmentClient)
remember: allowForever

Park the authorization request for the sign-in

#	If	Then
1	the rebuilt request is over 16 KiB	Refuse a request too large to park for the sign-in
2	the request is parked, for a request with no session	Send the browser to sign in, then back to the authorization request
3	the request is parked, for a stale cookie	Clear the stale session cookie and send the browser to sign in
4	the request is parked, for a disabled user's session	End the session of a disabled or deleted user and send the browser to sign in
5	the request is parked, for a step-up	Send the browser to sign in again before the grant

The first matching rule wins.

Exact conditions

#	Condition	Goes to	Situations
1	`requestTooLarge`	`invalid_request.authorization_too_large`	96888 of 193776
2	`noSession`	`sign_in_required.no_session`	32256 of 193776
3	`staleSession`	`sign_in_required.stale_session`	32256 of 193776
4	`accountDisabled`	`sign_in_required.account_disabled`	32256 of 193776
5	otherwise	`sign_in_required.fresh_login`	120 of 193776

noSession: gate == 'noSession'
staleSession: gate == 'staleSession'
accountDisabled: gate == 'accountDisabled'
requestTooLarge: returnUrl == 'tooLarge'

Every way it can end

It ends with	When	What happens
Send the authorization code to the client redirect with code + state + iss	The host is the primary host of an enabled realm, the address is under its limit, the query or form passes the route schema, and the request carries a live browser session of an enabled user, the authorization request, rebuilt for a sign-in redirect, is at most 16 KiB, client_id names a usable client, redirect_uri is one of its registered URIs that the environment permits, and dpop_jkt is absent, unread (DPoP off) or one base64url SHA-256 thumbprint, the scope parameter names no agent:* scope above the agent mode cap the operator set for the client, the resource indicators name no QAuth API audience (urn:qauth:aud:) that the client's own audience does not list, the client is not an agent: its is_agent is false, the client resolves to the production or staging profile, the posted csrf_token is the session's live value, the user pressed Allow, the posted scope, filtered by the client's allowlist, is the set the session bound for this client, and the posted resource fields name the bound resources, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, allow_forever is absent or any other value	Wait for a consent request: POST /ui/consent arrives for a page this walk did not render Find the realm of the host: the request has its realm Count the request against the authorize limit: the address is under its limit Check the form against the consent form schema: the form matches the schema Find the browser session: the session is live Check the CSRF value against the session's: the values are equal Burn the CSRF value: the value is burned Find the client again: the client is enabled and not suspended Check the redirect URI against the client and its environment again: the redirect URI is registered and permitted Read the DPoP key from the form: dpop_jkt is absent, unread or well formed Read the decision: the user pressed Allow Refuse an agent scope above the client's cap, where the code is minted: no agent scope is above the cap Grant only the scopes the page showed: the posted scopes are the shown ones Grant only the resources the page named: the posted resources are the named ones Ask for a fresh sign-in when the grant needs one: the sign-in is fresh enough, and the approval is for this request only Mint the authorization code: the code is stored Record the grant: the events are recorded
Tell the client the user denied the request redirect, error=access_denied	The host is the primary host of an enabled realm, the address is under its limit, the query or form passes the route schema, and the request carries a live browser session of an enabled user, the authorization request, rebuilt for a sign-in redirect, is at most 16 KiB, client_id names a usable client, redirect_uri is one of its registered URIs that the environment permits, and dpop_jkt is absent, unread (DPoP off) or one base64url SHA-256 thumbprint, the scope parameter names no agent:* scope above the agent mode cap the operator set for the client, the resource indicators name no QAuth API audience (urn:qauth:aud:) that the client's own audience does not list, the client is not an agent: its is_agent is false, the client resolves to the production or staging profile, the posted csrf_token is the session's live value, the user pressed Deny, the posted scope, filtered by the client's allowlist, is the set the session bound for this client, and the posted resource fields name the bound resources, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, allow_forever is absent or any other value	Wait for a consent request: POST /ui/consent arrives for a page this walk did not render Find the realm of the host: the request has its realm Count the request against the authorize limit: the address is under its limit Check the form against the consent form schema: the form matches the schema Find the browser session: the session is live Check the CSRF value against the session's: the values are equal Burn the CSRF value: the value is burned Find the client again: the client is enabled and not suspended Check the redirect URI against the client and its environment again: the redirect URI is registered and permitted Read the DPoP key from the form: dpop_jkt is absent, unread or well formed Read the decision: the user pressed Deny; consent.denied is recorded
Tell the client an agent scope is above its cap redirect, error=invalid_scope	The host is the primary host of an enabled realm, the address is under its limit, the query or form passes the route schema, and the request carries a live browser session of an enabled user, the authorization request, rebuilt for a sign-in redirect, is at most 16 KiB, client_id names a usable client, redirect_uri is one of its registered URIs that the environment permits, and dpop_jkt is absent, unread (DPoP off) or one base64url SHA-256 thumbprint, it names one (any agent:* scope for a client that is no agent or has no cap, or a mode above its cap), and an operator provisioned the client: the system client or the seed manifest, the resource indicators name no QAuth API audience (urn:qauth:aud:) that the client's own audience does not list, the client is not an agent: its is_agent is false, the client resolves to the production or staging profile, the posted csrf_token is the session's live value, the user pressed Allow, the posted scope, filtered by the client's allowlist, is the set the session bound for this client, and the posted resource fields name the bound resources, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, allow_forever is absent or any other value	Wait for a consent request: GET /ui/consent arrives, with the parameters of /oauth/authorize Find the realm of the host: the request has its realm Count the request against the global limit: the address is under its limit Check the query against the authorize schema: the query matches the schema Find the browser session: the session is live Find the client: the client is enabled and not suspended Check the redirect URI against the client and its environment: the redirect URI is registered and permitted Read the DPoP key the code is to be bound to: dpop_jkt is absent, unread or well formed Refuse an agent scope above the client's cap: an agent scope is above the cap, for a client an operator provisioned
Show, rather than redirect, the agent-cap error of a client no operator provisioned no redirect, page shown	The host is the primary host of an enabled realm, the address is under its limit, the query or form passes the route schema, and the request carries a live browser session of an enabled user, the authorization request, rebuilt for a sign-in redirect, is at most 16 KiB, client_id names a usable client, redirect_uri is one of its registered URIs that the environment permits, and dpop_jkt is absent, unread (DPoP off) or one base64url SHA-256 thumbprint, it names one, and the client registered itself: open registration, CIMD or a developer account, the resource indicators name no QAuth API audience (urn:qauth:aud:) that the client's own audience does not list, the client is not an agent: its is_agent is false, the client resolves to the production or staging profile, the posted csrf_token is the session's live value, the user pressed Allow, the posted scope, filtered by the client's allowlist, is the set the session bound for this client, and the posted resource fields name the bound resources, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, allow_forever is absent or any other value	Wait for a consent request: GET /ui/consent arrives, with the parameters of /oauth/authorize Find the realm of the host: the request has its realm Count the request against the global limit: the address is under its limit Check the query against the authorize schema: the query matches the schema Find the browser session: the session is live Find the client: the client is enabled and not suspended Check the redirect URI against the client and its environment: the redirect URI is registered and permitted Read the DPoP key the code is to be bound to: dpop_jkt is absent, unread or well formed Refuse an agent scope above the client's cap: an agent scope is above the cap, for a client no operator provisioned
Refuse a scope set the page did not show redirect, error=invalid_scope	The host is the primary host of an enabled realm, the address is under its limit, the query or form passes the route schema, and the request carries a live browser session of an enabled user, the authorization request, rebuilt for a sign-in redirect, is at most 16 KiB, client_id names a usable client, redirect_uri is one of its registered URIs that the environment permits, and dpop_jkt is absent, unread (DPoP off) or one base64url SHA-256 thumbprint, the scope parameter names no agent:* scope above the agent mode cap the operator set for the client, the resource indicators name no QAuth API audience (urn:qauth:aud:) that the client's own audience does not list, the client is not an agent: its is_agent is false, the client resolves to the production or staging profile, the posted csrf_token is the session's live value, the user pressed Allow, the posted scopes are another set, such as a tampered hidden field, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, allow_forever is absent or any other value	Wait for a consent request: POST /ui/consent arrives for a page this walk did not render Find the realm of the host: the request has its realm Count the request against the authorize limit: the address is under its limit Check the form against the consent form schema: the form matches the schema Find the browser session: the session is live Check the CSRF value against the session's: the values are equal Burn the CSRF value: the value is burned Find the client again: the client is enabled and not suspended Check the redirect URI against the client and its environment again: the redirect URI is registered and permitted Read the DPoP key from the form: dpop_jkt is absent, unread or well formed Read the decision: the user pressed Allow Refuse an agent scope above the client's cap, where the code is minted: no agent scope is above the cap Grant only the scopes the page showed: the posted scopes are not the ones the page showed; consent.denied is recorded
Refuse a resource set the page did not name redirect, error=invalid_target	The host is the primary host of an enabled realm, the address is under its limit, the query or form passes the route schema, and the request carries a live browser session of an enabled user, the authorization request, rebuilt for a sign-in redirect, is at most 16 KiB, client_id names a usable client, redirect_uri is one of its registered URIs that the environment permits, and dpop_jkt is absent, unread (DPoP off) or one base64url SHA-256 thumbprint, the scope parameter names no agent:* scope above the agent mode cap the operator set for the client, the resource indicators name no QAuth API audience (urn:qauth:aud:) that the client's own audience does not list, the client is not an agent: its is_agent is false, the client resolves to the production or staging profile, the posted csrf_token is the session's live value, the user pressed Allow, the scopes match, but the resource fields name other resources, or none where the page named some, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, allow_forever is absent or any other value	Wait for a consent request: POST /ui/consent arrives for a page this walk did not render Find the realm of the host: the request has its realm Count the request against the authorize limit: the address is under its limit Check the form against the consent form schema: the form matches the schema Find the browser session: the session is live Check the CSRF value against the session's: the values are equal Burn the CSRF value: the value is burned Find the client again: the client is enabled and not suspended Check the redirect URI against the client and its environment again: the redirect URI is registered and permitted Read the DPoP key from the form: dpop_jkt is absent, unread or well formed Read the decision: the user pressed Allow Refuse an agent scope above the client's cap, where the code is minted: no agent scope is above the cap Grant only the scopes the page showed: the posted scopes are the shown ones Grant only the resources the page named: the posted resources are not the ones the page named; consent.denied is recorded
Tell the client it named a QAuth API audience it does not list redirect, error=invalid_target	The host is the primary host of an enabled realm, the address is under its limit, the query or form passes the route schema, and the request carries a live browser session of an enabled user, the authorization request, rebuilt for a sign-in redirect, is at most 16 KiB, client_id names a usable client, redirect_uri is one of its registered URIs that the environment permits, and dpop_jkt is absent, unread (DPoP off) or one base64url SHA-256 thumbprint, the scope parameter names no agent:* scope above the agent mode cap the operator set for the client, they name one, and an operator provisioned the client: the system client or the seed manifest, the client is not an agent: its is_agent is false, the client resolves to the production or staging profile, the posted csrf_token is the session's live value, the user pressed Allow, the posted scope, filtered by the client's allowlist, is the set the session bound for this client, and the posted resource fields name the bound resources, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, allow_forever is absent or any other value	Wait for a consent request: GET /ui/consent arrives, with the parameters of /oauth/authorize Find the realm of the host: the request has its realm Count the request against the global limit: the address is under its limit Check the query against the authorize schema: the query matches the schema Find the browser session: the session is live Find the client: the client is enabled and not suspended Check the redirect URI against the client and its environment: the redirect URI is registered and permitted Read the DPoP key the code is to be bound to: dpop_jkt is absent, unread or well formed Refuse an agent scope above the client's cap: no agent scope is above the cap Describe the client from the server's own records: the client is described; the scopes to show are the requested ones the client's allowlist holds Refuse a QAuth API audience the client does not list: a resource names a QAuth API audience the client does not list, for a client an operator provisioned
Show, rather than redirect, the unlisted-audience error of a client no operator provisioned no redirect, page shown	The host is the primary host of an enabled realm, the address is under its limit, the query or form passes the route schema, and the request carries a live browser session of an enabled user, the authorization request, rebuilt for a sign-in redirect, is at most 16 KiB, client_id names a usable client, redirect_uri is one of its registered URIs that the environment permits, and dpop_jkt is absent, unread (DPoP off) or one base64url SHA-256 thumbprint, the scope parameter names no agent:* scope above the agent mode cap the operator set for the client, they name one, and the client registered itself: open registration, CIMD or a developer account; an open registration or CIMD client lists none, whatever its row holds, the client is not an agent: its is_agent is false, the client resolves to the production or staging profile, the posted csrf_token is the session's live value, the user pressed Allow, the posted scope, filtered by the client's allowlist, is the set the session bound for this client, and the posted resource fields name the bound resources, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, allow_forever is absent or any other value	Wait for a consent request: GET /ui/consent arrives, with the parameters of /oauth/authorize Find the realm of the host: the request has its realm Count the request against the global limit: the address is under its limit Check the query against the authorize schema: the query matches the schema Find the browser session: the session is live Find the client: the client is enabled and not suspended Check the redirect URI against the client and its environment: the redirect URI is registered and permitted Read the DPoP key the code is to be bound to: dpop_jkt is absent, unread or well formed Refuse an agent scope above the client's cap: no agent scope is above the cap Describe the client from the server's own records: the client is described; the scopes to show are the requested ones the client's allowlist holds Refuse a QAuth API audience the client does not list: a resource names a QAuth API audience the client does not list, for a client no operator provisioned
Send the browser to sign in, then back to the authorization request no redirect, page shown	The request carries no session cookie, or one that names a cookie key this process has not read yet and may not read again yet (#493), which is left for the next request, the authorization request, rebuilt for a sign-in redirect, is at most 16 KiB, client_id names a usable client, redirect_uri is one of its registered URIs that the environment permits, and dpop_jkt is absent, unread (DPoP off) or one base64url SHA-256 thumbprint, the scope parameter names no agent:* scope above the agent mode cap the operator set for the client, the resource indicators name no QAuth API audience (urn:qauth:aud:) that the client's own audience does not list, the client is not an agent: its is_agent is false, the client resolves to the production or staging profile, the posted csrf_token is the session's live value, the user pressed Allow, the posted scope, filtered by the client's allowlist, is the set the session bound for this client, and the posted resource fields name the bound resources, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, allow_forever is absent or any other value	Wait for a consent request: GET /ui/consent arrives, with the parameters of /oauth/authorize Find the realm of the host: the request has its realm Count the request against the global limit: the address is under its limit Check the query against the authorize schema: the query matches the schema Find the browser session: the request carries no session; the authorize URL is rebuilt from the query Park the authorization request for the sign-in: the request is parked, for a request with no session
Clear the stale session cookie and send the browser to sign in no redirect, page shown	The cookie does not verify with the realm's cookie keys (#493), or it does but its session has ended or expired, the authorization request, rebuilt for a sign-in redirect, is at most 16 KiB, client_id names a usable client, redirect_uri is one of its registered URIs that the environment permits, and dpop_jkt is absent, unread (DPoP off) or one base64url SHA-256 thumbprint, the scope parameter names no agent:* scope above the agent mode cap the operator set for the client, the resource indicators name no QAuth API audience (urn:qauth:aud:) that the client's own audience does not list, the client is not an agent: its is_agent is false, the client resolves to the production or staging profile, the posted csrf_token is the session's live value, the user pressed Allow, the posted scope, filtered by the client's allowlist, is the set the session bound for this client, and the posted resource fields name the bound resources, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, allow_forever is absent or any other value	Wait for a consent request: GET /ui/consent arrives, with the parameters of /oauth/authorize Find the realm of the host: the request has its realm Count the request against the global limit: the address is under its limit Check the query against the authorize schema: the query matches the schema Find the browser session: the cookie does not verify, or names a session that has ended, and is cleared Park the authorization request for the sign-in: the request is parked, for a stale cookie
End the session of a disabled or deleted user and send the browser to sign in no redirect, page shown	The session is live, but its user has been deleted or disabled, or was disabled after the session began and enabled again since, the authorization request, rebuilt for a sign-in redirect, is at most 16 KiB, client_id names a usable client, redirect_uri is one of its registered URIs that the environment permits, and dpop_jkt is absent, unread (DPoP off) or one base64url SHA-256 thumbprint, the scope parameter names no agent:* scope above the agent mode cap the operator set for the client, the resource indicators name no QAuth API audience (urn:qauth:aud:) that the client's own audience does not list, the client is not an agent: its is_agent is false, the client resolves to the production or staging profile, the posted csrf_token is the session's live value, the user pressed Allow, the posted scope, filtered by the client's allowlist, is the set the session bound for this client, and the posted resource fields name the bound resources, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, allow_forever is absent or any other value	Wait for a consent request: GET /ui/consent arrives, with the parameters of /oauth/authorize Find the realm of the host: the request has its realm Count the request against the global limit: the address is under its limit Check the query against the authorize schema: the query matches the schema Find the browser session: the session's user is gone or disabled, or was disabled after the session began; the session is ended and its cookie cleared Park the authorization request for the sign-in: the request is parked, for a disabled user's session
Send the browser to sign in again before the grant no redirect, page shown	The host is the primary host of an enabled realm, the address is under its limit, the query or form passes the route schema, and the request carries a live browser session of an enabled user, the authorization request, rebuilt for a sign-in redirect, is at most 16 KiB, client_id names a usable client, redirect_uri is one of its registered URIs that the environment permits, and dpop_jkt is absent, unread (DPoP off) or one base64url SHA-256 thumbprint, the scope parameter names no agent:* scope above the agent mode cap the operator set for the client, the resource indicators name no QAuth API audience (urn:qauth:aud:) that the client's own audience does not list, the client is not an agent: its is_agent is false, the client resolves to the production or staging profile, the posted csrf_token is the session's live value, the user pressed Allow, the posted scope, filtered by the client's allowlist, is the set the session bound for this client, and the posted resource fields name the bound resources, the form carries prompt=login, or the client's first-party profile is native_backend, whose request asks for a fresh sign-in as prompt=login does whatever the form says (ADR-017 Decision 9), and the sign-in is more than two minutes old, allow_forever is absent or any other value	Wait for a consent request: POST /ui/consent arrives for a page this walk did not render Find the realm of the host: the request has its realm Count the request against the authorize limit: the address is under its limit Check the form against the consent form schema: the form matches the schema Find the browser session: the session is live Check the CSRF value against the session's: the values are equal Burn the CSRF value: the value is burned Find the client again: the client is enabled and not suspended Check the redirect URI against the client and its environment again: the redirect URI is registered and permitted Read the DPoP key from the form: dpop_jkt is absent, unread or well formed Read the decision: the user pressed Allow Refuse an agent scope above the client's cap, where the code is minted: no agent scope is above the cap Grant only the scopes the page showed: the posted scopes are the shown ones Grant only the resources the page named: the posted resources are the named ones Ask for a fresh sign-in when the grant needs one: the sign-in is too old for what is asked; step_up.required is recorded Park the authorization request for the sign-in: the request is parked, for a step-up
Refuse a request too large to park for the sign-in no redirect, page shown	The request carries no session cookie, or one that names a cookie key this process has not read yet and may not read again yet (#493), which is left for the next request, it is longer: the rebuild encodes each ~ ! ' ( ) of the parameters as three bytes, so a request line of some 8 KiB can give 24 KiB, client_id names a usable client, redirect_uri is one of its registered URIs that the environment permits, and dpop_jkt is absent, unread (DPoP off) or one base64url SHA-256 thumbprint, the scope parameter names no agent:* scope above the agent mode cap the operator set for the client, the resource indicators name no QAuth API audience (urn:qauth:aud:) that the client's own audience does not list, the client is not an agent: its is_agent is false, the client resolves to the production or staging profile, the posted csrf_token is the session's live value, the user pressed Allow, the posted scope, filtered by the client's allowlist, is the set the session bound for this client, and the posted resource fields name the bound resources, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, allow_forever is absent or any other value	Wait for a consent request: GET /ui/consent arrives, with the parameters of /oauth/authorize Find the realm of the host: the request has its realm Count the request against the global limit: the address is under its limit Check the query against the authorize schema: the query matches the schema Find the browser session: the request carries no session; the authorize URL is rebuilt from the query Park the authorization request for the sign-in: the rebuilt request is over 16 KiB
Refuse a form whose CSRF value is not the session's no redirect, page shown	The host is the primary host of an enabled realm, the address is under its limit, the query or form passes the route schema, and the request carries a live browser session of an enabled user, the authorization request, rebuilt for a sign-in redirect, is at most 16 KiB, client_id names a usable client, redirect_uri is one of its registered URIs that the environment permits, and dpop_jkt is absent, unread (DPoP off) or one base64url SHA-256 thumbprint, the scope parameter names no agent:* scope above the agent mode cap the operator set for the client, the resource indicators name no QAuth API audience (urn:qauth:aud:) that the client's own audience does not list, the client is not an agent: its is_agent is false, the client resolves to the production or staging profile, it is another value, one an earlier POST of the session burned, or the session holds none; a form with no csrf_token fails the schema instead, the user pressed Allow, the posted scope, filtered by the client's allowlist, is the set the session bound for this client, and the posted resource fields name the bound resources, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, allow_forever is absent or any other value	Wait for a consent request: POST /ui/consent arrives for a page this walk did not render Find the realm of the host: the request has its realm Count the request against the authorize limit: the address is under its limit Check the form against the consent form schema: the form matches the schema Find the browser session: the session is live Check the CSRF value against the session's: the posted value is not the session's live one
Refuse a client_id that names no client no redirect, page shown	The host is the primary host of an enabled realm, the address is under its limit, the query or form passes the route schema, and the request carries a live browser session of an enabled user, the authorization request, rebuilt for a sign-in redirect, is at most 16 KiB, client_id names no client of the realm, or a CIMD document that does not resolve, the scope parameter names no agent:* scope above the agent mode cap the operator set for the client, the resource indicators name no QAuth API audience (urn:qauth:aud:) that the client's own audience does not list, the client is not an agent: its is_agent is false, the client resolves to the production or staging profile, the posted csrf_token is the session's live value, the user pressed Allow, the posted scope, filtered by the client's allowlist, is the set the session bound for this client, and the posted resource fields name the bound resources, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, allow_forever is absent or any other value	Wait for a consent request: GET /ui/consent arrives, with the parameters of /oauth/authorize Find the realm of the host: the request has its realm Count the request against the global limit: the address is under its limit Check the query against the authorize schema: the query matches the schema Find the browser session: the session is live Find the client: the client_id names no client of the realm
Refuse a client that is disabled or suspended no redirect, page shown	The host is the primary host of an enabled realm, the address is under its limit, the query or form passes the route schema, and the request carries a live browser session of an enabled user, the authorization request, rebuilt for a sign-in redirect, is at most 16 KiB, client_id names a client that is disabled or suspended, the scope parameter names no agent:* scope above the agent mode cap the operator set for the client, the resource indicators name no QAuth API audience (urn:qauth:aud:) that the client's own audience does not list, the client is not an agent: its is_agent is false, the client resolves to the production or staging profile, the posted csrf_token is the session's live value, the user pressed Allow, the posted scope, filtered by the client's allowlist, is the set the session bound for this client, and the posted resource fields name the bound resources, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, allow_forever is absent or any other value	Wait for a consent request: GET /ui/consent arrives, with the parameters of /oauth/authorize Find the realm of the host: the request has its realm Count the request against the global limit: the address is under its limit Check the query against the authorize schema: the query matches the schema Find the browser session: the session is live Find the client: the client is disabled or suspended
Refuse a redirect URI the client did not register no redirect, page shown	The host is the primary host of an enabled realm, the address is under its limit, the query or form passes the route schema, and the request carries a live browser session of an enabled user, the authorization request, rebuilt for a sign-in redirect, is at most 16 KiB, redirect_uri is none of the client's, the scope parameter names no agent:* scope above the agent mode cap the operator set for the client, the resource indicators name no QAuth API audience (urn:qauth:aud:) that the client's own audience does not list, the client is not an agent: its is_agent is false, the client resolves to the production or staging profile, the posted csrf_token is the session's live value, the user pressed Allow, the posted scope, filtered by the client's allowlist, is the set the session bound for this client, and the posted resource fields name the bound resources, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, allow_forever is absent or any other value	Wait for a consent request: GET /ui/consent arrives, with the parameters of /oauth/authorize Find the realm of the host: the request has its realm Count the request against the global limit: the address is under its limit Check the query against the authorize schema: the query matches the schema Find the browser session: the session is live Find the client: the client is enabled and not suspended Check the redirect URI against the client and its environment: redirect_uri is not registered for the client
Refuse a registered redirect URI that no environment permits no redirect, page shown	The host is the primary host of an enabled realm, the address is under its limit, the query or form passes the route schema, and the request carries a live browser session of an enabled user, the authorization request, rebuilt for a sign-in redirect, is at most 16 KiB, redirect_uri is the client's, but no environment permits it: a scheme outside the allowed ones, or plain http to a host that is not loopback, the scope parameter names no agent:* scope above the agent mode cap the operator set for the client, the resource indicators name no QAuth API audience (urn:qauth:aud:) that the client's own audience does not list, the client is not an agent: its is_agent is false, the client resolves to the production or staging profile, the posted csrf_token is the session's live value, the user pressed Allow, the posted scope, filtered by the client's allowlist, is the set the session bound for this client, and the posted resource fields name the bound resources, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, allow_forever is absent or any other value	Wait for a consent request: GET /ui/consent arrives, with the parameters of /oauth/authorize Find the realm of the host: the request has its realm Count the request against the global limit: the address is under its limit Check the query against the authorize schema: the query matches the schema Find the browser session: the session is live Find the client: the client is enabled and not suspended Check the redirect URI against the client and its environment: no environment permits that redirect_uri
Refuse a dpop_jkt that is not a key thumbprint no redirect, page shown	The host is the primary host of an enabled realm, the address is under its limit, the query or form passes the route schema, and the request carries a live browser session of an enabled user, the authorization request, rebuilt for a sign-in redirect, is at most 16 KiB, DPoP is on and dpop_jkt is not one thumbprint, the scope parameter names no agent:* scope above the agent mode cap the operator set for the client, the resource indicators name no QAuth API audience (urn:qauth:aud:) that the client's own audience does not list, the client is not an agent: its is_agent is false, the client resolves to the production or staging profile, the posted csrf_token is the session's live value, the user pressed Allow, the posted scope, filtered by the client's allowlist, is the set the session bound for this client, and the posted resource fields name the bound resources, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, allow_forever is absent or any other value	Wait for a consent request: GET /ui/consent arrives, with the parameters of /oauth/authorize Find the realm of the host: the request has its realm Count the request against the global limit: the address is under its limit Check the query against the authorize schema: the query matches the schema Find the browser session: the session is live Find the client: the client is enabled and not suspended Check the redirect URI against the client and its environment: the redirect URI is registered and permitted Read the DPoP key the code is to be bound to: dpop_jkt is not one thumbprint
Refuse a redirect URI the screen cannot show no redirect, page shown	The host is the primary host of an enabled realm, the address is under its limit, the query or form passes the route schema, and the request carries a live browser session of an enabled user, the authorization request, rebuilt for a sign-in redirect, is at most 16 KiB, every other parameter is valid, but the client display data (#593) cannot show where redirect_uri goes: an IPv6 address that is not loopback, a host that is not a DNS name of valid labels, or a scheme over 64 characters. Every registration path refuses such a URI since #593, so only an older client holds one; read by the GET only, after the agent cap, the scope parameter names no agent:* scope above the agent mode cap the operator set for the client, the resource indicators name no QAuth API audience (urn:qauth:aud:) that the client's own audience does not list, the client is not an agent: its is_agent is false, the client resolves to the production or staging profile, the posted csrf_token is the session's live value, the user pressed Allow, the posted scope, filtered by the client's allowlist, is the set the session bound for this client, and the posted resource fields name the bound resources, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, allow_forever is absent or any other value	Wait for a consent request: GET /ui/consent arrives, with the parameters of /oauth/authorize Find the realm of the host: the request has its realm Count the request against the global limit: the address is under its limit Check the query against the authorize schema: the query matches the schema Find the browser session: the session is live Find the client: the client is enabled and not suspended Check the redirect URI against the client and its environment: the redirect URI is registered and permitted Read the DPoP key the code is to be bound to: dpop_jkt is absent, unread or well formed Refuse an agent scope above the client's cap: no agent scope is above the cap Describe the client from the server's own records: the client display data cannot show where the redirect URI goes
Refuse a query that does not match the authorize schema no redirect, page shown	The query (GET) or the form (POST) does not pass the route schema, such as a missing code_challenge or decision, the authorization request, rebuilt for a sign-in redirect, is at most 16 KiB, client_id names a usable client, redirect_uri is one of its registered URIs that the environment permits, and dpop_jkt is absent, unread (DPoP off) or one base64url SHA-256 thumbprint, the scope parameter names no agent:* scope above the agent mode cap the operator set for the client, the resource indicators name no QAuth API audience (urn:qauth:aud:) that the client's own audience does not list, the client is not an agent: its is_agent is false, the client resolves to the production or staging profile, the posted csrf_token is the session's live value, the user pressed Allow, the posted scope, filtered by the client's allowlist, is the set the session bound for this client, and the posted resource fields name the bound resources, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, allow_forever is absent or any other value	Wait for a consent request: GET /ui/consent arrives, with the parameters of /oauth/authorize Find the realm of the host: the request has its realm Count the request against the global limit: the address is under its limit Check the query against the authorize schema: the query does not match the schema
Refuse a form that does not match the consent form schema no redirect, page shown	The query (GET) or the form (POST) does not pass the route schema, such as a missing code_challenge or decision, the authorization request, rebuilt for a sign-in redirect, is at most 16 KiB, client_id names a usable client, redirect_uri is one of its registered URIs that the environment permits, and dpop_jkt is absent, unread (DPoP off) or one base64url SHA-256 thumbprint, the scope parameter names no agent:* scope above the agent mode cap the operator set for the client, the resource indicators name no QAuth API audience (urn:qauth:aud:) that the client's own audience does not list, the client is not an agent: its is_agent is false, the client resolves to the production or staging profile, the posted csrf_token is the session's live value, the user pressed Allow, the posted scope, filtered by the client's allowlist, is the set the session bound for this client, and the posted resource fields name the bound resources, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, allow_forever is absent or any other value	Wait for a consent request: POST /ui/consent arrives for a page this walk did not render Find the realm of the host: the request has its realm Count the request against the authorize limit: the address is under its limit Check the form against the consent form schema: the form does not match the schema
Refuse a host that serves no browser route no redirect, page shown	The host names no realm, a disabled realm or a realm with no issuer, the authorization request, rebuilt for a sign-in redirect, is at most 16 KiB, client_id names a usable client, redirect_uri is one of its registered URIs that the environment permits, and dpop_jkt is absent, unread (DPoP off) or one base64url SHA-256 thumbprint, the scope parameter names no agent:* scope above the agent mode cap the operator set for the client, the resource indicators name no QAuth API audience (urn:qauth:aud:) that the client's own audience does not list, the client is not an agent: its is_agent is false, the client resolves to the production or staging profile, the posted csrf_token is the session's live value, the user pressed Allow, the posted scope, filtered by the client's allowlist, is the set the session bound for this client, and the posted resource fields name the bound resources, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, allow_forever is absent or any other value	Wait for a consent request: GET /ui/consent arrives, with the parameters of /oauth/authorize Find the realm of the host: the host names no enabled realm with an issuer
Refuse a GET over the global limit no redirect, page shown	The address has used up its requests for the window: the global limit for the GET, the authorize limit for the POST, the authorization request, rebuilt for a sign-in redirect, is at most 16 KiB, client_id names a usable client, redirect_uri is one of its registered URIs that the environment permits, and dpop_jkt is absent, unread (DPoP off) or one base64url SHA-256 thumbprint, the scope parameter names no agent:* scope above the agent mode cap the operator set for the client, the resource indicators name no QAuth API audience (urn:qauth:aud:) that the client's own audience does not list, the client is not an agent: its is_agent is false, the client resolves to the production or staging profile, the posted csrf_token is the session's live value, the user pressed Allow, the posted scope, filtered by the client's allowlist, is the set the session bound for this client, and the posted resource fields name the bound resources, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, allow_forever is absent or any other value	Wait for a consent request: GET /ui/consent arrives, with the parameters of /oauth/authorize Find the realm of the host: the request has its realm Count the request against the global limit: the address has used up its requests
Refuse a POST over the authorize limit no redirect, page shown	The address has used up its requests for the window: the global limit for the GET, the authorize limit for the POST, the authorization request, rebuilt for a sign-in redirect, is at most 16 KiB, client_id names a usable client, redirect_uri is one of its registered URIs that the environment permits, and dpop_jkt is absent, unread (DPoP off) or one base64url SHA-256 thumbprint, the scope parameter names no agent:* scope above the agent mode cap the operator set for the client, the resource indicators name no QAuth API audience (urn:qauth:aud:) that the client's own audience does not list, the client is not an agent: its is_agent is false, the client resolves to the production or staging profile, the posted csrf_token is the session's live value, the user pressed Allow, the posted scope, filtered by the client's allowlist, is the set the session bound for this client, and the posted resource fields name the bound resources, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, allow_forever is absent or any other value	Wait for a consent request: POST /ui/consent arrives for a page this walk did not render Find the realm of the host: the request has its realm Count the request against the authorize limit: the address has used up its authorize requests
Fail on a session cookie that cannot be decoded no redirect, page shown	The request carries a session cookie whose value is not valid percent-encoding, such as %zz, which the cookie reader decodes without a catch, the authorization request, rebuilt for a sign-in redirect, is at most 16 KiB, client_id names a usable client, redirect_uri is one of its registered URIs that the environment permits, and dpop_jkt is absent, unread (DPoP off) or one base64url SHA-256 thumbprint, the scope parameter names no agent:* scope above the agent mode cap the operator set for the client, the resource indicators name no QAuth API audience (urn:qauth:aud:) that the client's own audience does not list, the client is not an agent: its is_agent is false, the client resolves to the production or staging profile, the posted csrf_token is the session's live value, the user pressed Allow, the posted scope, filtered by the client's allowlist, is the set the session bound for this client, and the posted resource fields name the bound resources, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, allow_forever is absent or any other value	Wait for a consent request: GET /ui/consent arrives, with the parameters of /oauth/authorize Find the realm of the host: the request has its realm Count the request against the global limit: the address is under its limit Check the query against the authorize schema: the query matches the schema Find the browser session: the session cookie cannot be decoded
Fail on a store error no redirect, page shown	The host is the primary host of an enabled realm, the address is under its limit, the query or form passes the route schema, and the request carries a live browser session of an enabled user, the authorization request, rebuilt for a sign-in redirect, is at most 16 KiB, client_id names a usable client, redirect_uri is one of its registered URIs that the environment permits, and dpop_jkt is absent, unread (DPoP off) or one base64url SHA-256 thumbprint, the scope parameter names no agent:* scope above the agent mode cap the operator set for the client, the resource indicators name no QAuth API audience (urn:qauth:aud:) that the client's own audience does not list, the client is not an agent: its is_agent is false, the client resolves to the production or staging profile, the posted csrf_token is the session's live value, the user pressed Allow, the posted scope, filtered by the client's allowlist, is the set the session bound for this client, and the posted resource fields name the bound resources, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, allow_forever is absent or any other value	Wait for a consent request: POST /ui/consent arrives for a page this walk did not render Find the realm of the host: the request has its realm Count the request against the authorize limit: the address is under its limit Check the form against the consent form schema: the form matches the schema Find the browser session: the session is live Check the CSRF value against the session's: the values are equal Burn the CSRF value: it fails, because the cache fails

Each row is also a generated test: set the starting situation, send the events, expect the ending.

What is guaranteed

These hold in all 5414976 situations the model can reach, from 580608 different starting situations.

The page is shown only for a live session, a usable client, a permitted redirect URI and agent scopes within the cap, so the user is never asked about a request the POST would refuse for those reasons
No page is shown, and no scope or resource is bound to the session, for a request whose resource indicators name a QAuth API audience the client does not list; the POST grants only what a GET bound
Nothing is saved or minted for a form that does not carry the session's live CSRF value
A form that passes the CSRF check has spent its value before anything else is checked, so it cannot be posted again, whatever it ends in
A consent is saved and a code minted only for the scopes and resources the page showed
A denial saves no consent and mints no code, whatever scopes the form carries
No consent is saved and no code minted for an agent scope above the client's cap
No consent is saved and no code minted on a sign-in older than what the request or its scopes ask for
A consent is saved only when the form carries allow_forever=1
A code reaches the client only once it is stored, and after the consent is saved when the user asked for it
An agent client is shown only the page that names it as an AI agent and says how long it may keep working, and a client that is not an agent never is

Exact rules

Id	Never
`page-only-for-a-request-the-post-accepts`	`state in ['rendered', 'renderedForAgent'] and (gate != 'open' or params != 'valid' or overAgentCap)`
`no-page-for-an-unlisted-reserved-audience`	`state in ['bindingScopes', 'rendered', 'renderedForAgent'] and audienceUnlisted`
`no-code-without-the-live-csrf-value`	`state in ['savingConsent', 'mintingCode', 'recordingGrant', 'code_issued'] and csrfWrong`
`csrf-value-spent-before-the-client-is-read`	`state in ['submitCheckingClient', 'submitCheckingRedirectUri', 'submitReadingDpopKey', 'readingDecision', 'submitCheckingAgentCap', 'checkingScopeBinding', 'checkingResourceBinding', 'checkingStepUp', 'savingConsent', 'mintingCode', 'recordingGrant', 'code_issued'] and not csrfBurned`
`only-the-shown-scopes-and-resources-are-granted`	`state in ['savingConsent', 'mintingCode', 'recordingGrant', 'code_issued'] and posted != 'shown'`
`deny-mints-nothing`	`(state in ['savingConsent', 'mintingCode', 'recordingGrant', 'code_issued'] or consentSaved or codeMinted) and denied`
`no-code-above-the-agent-cap`	`state in ['savingConsent', 'mintingCode', 'recordingGrant', 'code_issued'] and overAgentCap`
`no-code-on-a-stale-sign-in`	`state in ['savingConsent', 'mintingCode', 'recordingGrant', 'code_issued'] and needsFreshLogin`
`remembered-only-when-asked`	`consentSaved and not allowForever`
`code-issued-means-minted-and-remembered-as-asked`	`state == 'code_issued' and (not codeMinted or (allowForever and not consentSaved))`
`an-agent-is-named-as-one`	`(state == 'rendered' and agentClient) or (state == 'renderedForAgent' and not agentClient)`

Reference

All transitions (83)

From	Event	Guard	To	Effects	Taken
`idle`	`SHOW`		`showResolvingRealm`		yes
`idle`	`SUBMIT`		`submitResolvingRealm`		yes
`showResolvingRealm`	`rule 1`	`hostUnknown`	`misdirected_request.host`		yes
`showResolvingRealm`	`rule 2`	`endpointHost`	`misdirected_request.host`		yes
`showResolvingRealm`	`rule 3`		`showRateLimiting`		yes
`showRateLimiting`	`rule 1`	`rateLimited`	`too_many_requests.global_limit`		yes
`showRateLimiting`	`rule 2`		`showValidatingQuery`		yes
`showValidatingQuery`	`rule 1`	`inputInvalid`	`validation_error.query`		yes
`showValidatingQuery`	`rule 2`		`showFindingSession`		yes
`showFindingSession`	`rule 1`	`cookieMalformed`	`server_error.malformed_cookie`		yes
`showFindingSession`	`rule 2`	`noSession`	`parkingRequest`		yes
`showFindingSession`	`rule 3`	`staleSession`	`parkingRequest`		yes
`showFindingSession`	`rule 4`	`accountDisabled`	`parkingRequest`		yes
`showFindingSession`	`rule 5`		`showCheckingClient`		yes
`showCheckingClient`	`rule 1`	`clientUnknown`	`invalid_request.unknown_client`		yes
`showCheckingClient`	`rule 2`	`clientUnusable`	`unauthorized_client.disabled`		yes
`showCheckingClient`	`rule 3`		`showCheckingRedirectUri`		yes
`showCheckingRedirectUri`	`rule 1`	`redirectUnregistered`	`invalid_request.redirect_uri_not_registered`		yes
`showCheckingRedirectUri`	`rule 2`	`redirectNotPermitted`	`invalid_request.redirect_uri_not_permitted`		yes
`showCheckingRedirectUri`	`rule 3`		`showReadingDpopKey`		yes
`showReadingDpopKey`	`rule 1`	`dpopJktMalformed`	`invalid_request.malformed_dpop_jkt`		yes
`showReadingDpopKey`	`rule 2`		`showCheckingAgentCap`		yes
`showCheckingAgentCap`	`rule 1`	`overAgentCapShown`	`invalid_scope.agent_scope_mode_exceeded_shown`		yes
`showCheckingAgentCap`	`rule 2`	`overAgentCap`	`invalid_scope.agent_scope_mode_exceeded`		yes
`showCheckingAgentCap`	`rule 3`		`showDescribingClient`		yes
`showDescribingClient`	`rule 1`	`redirectNotShown`	`invalid_request.redirect_uri_not_shown`		yes
`showDescribingClient`	`rule 2`		`showCheckingAudience`		yes
`showCheckingAudience`	`rule 1`	`audienceUnlistedShown`	`invalid_target.unlisted_reserved_audience_shown`		yes
`showCheckingAudience`	`rule 2`	`audienceUnlisted`	`invalid_target.unlisted_reserved_audience`		yes
`showCheckingAudience`	`rule 3`		`bindingScopes`		yes
`bindingScopes`	`DONE`	`agentClient`	`renderedForAgent`		yes
`bindingScopes`	`DONE`	`developmentClient`	`rendered`		yes
`bindingScopes`	`DONE`		`rendered`		yes
`bindingScopes`	`FAIL.server`		`server_error.store`		yes
`rendered`	`SUBMIT`		`submitResolvingRealm`		yes
`renderedForAgent`	`SUBMIT`		`submitResolvingRealm`		yes
`submitResolvingRealm`	`rule 1`	`hostUnknown`	`misdirected_request.host`		yes
`submitResolvingRealm`	`rule 2`	`endpointHost`	`misdirected_request.host`		yes
`submitResolvingRealm`	`rule 3`		`submitRateLimiting`		yes
`submitRateLimiting`	`rule 1`	`rateLimited`	`too_many_requests.authorize_limit`		yes
`submitRateLimiting`	`rule 2`		`submitValidatingForm`		yes
`submitValidatingForm`	`rule 1`	`inputInvalid`	`validation_error.form`		yes
`submitValidatingForm`	`rule 2`		`submitFindingSession`		yes
`submitFindingSession`	`rule 1`	`cookieMalformed`	`server_error.malformed_cookie`		yes
`submitFindingSession`	`rule 2`	`noSession`	`parkingRequest`		yes
`submitFindingSession`	`rule 3`	`staleSession`	`parkingRequest`		yes
`submitFindingSession`	`rule 4`	`accountDisabled`	`parkingRequest`		yes
`submitFindingSession`	`rule 5`		`checkingCsrf`		yes
`checkingCsrf`	`rule 1`	`csrfWrong`	`invalid_csrf_token.mismatch`		yes
`checkingCsrf`	`rule 2`		`burningCsrf`		yes
`burningCsrf`	`DONE`		`submitCheckingClient`	`burnCsrf`	yes
`burningCsrf`	`FAIL.server`		`server_error.store`		yes
`submitCheckingClient`	`rule 1`	`clientUnknown`	`invalid_request.unknown_client`		yes
`submitCheckingClient`	`rule 2`	`clientUnusable`	`unauthorized_client.disabled`		yes
`submitCheckingClient`	`rule 3`		`submitCheckingRedirectUri`		yes
`submitCheckingRedirectUri`	`rule 1`	`redirectUnregistered`	`invalid_request.redirect_uri_not_registered`		yes
`submitCheckingRedirectUri`	`rule 2`	`redirectNotPermitted`	`invalid_request.redirect_uri_not_permitted`		yes
`submitCheckingRedirectUri`	`rule 3`		`submitReadingDpopKey`		yes
`submitReadingDpopKey`	`rule 1`	`dpopJktMalformed`	`invalid_request.malformed_dpop_jkt`		yes
`submitReadingDpopKey`	`rule 2`		`readingDecision`		yes
`readingDecision`	`rule 1`	`denied`	`access_denied.user_denied`		yes
`readingDecision`	`rule 2`		`submitCheckingAgentCap`		yes
`submitCheckingAgentCap`	`rule 1`	`overAgentCap`	`invalid_scope.agent_scope_mode_exceeded`		yes
`submitCheckingAgentCap`	`rule 2`		`checkingScopeBinding`		yes
`checkingScopeBinding`	`rule 1`	`scopesUnbound`	`invalid_scope.consent_scope_mismatch`		yes
`checkingScopeBinding`	`rule 2`	`scopesDiffer`	`invalid_scope.consent_scope_mismatch`		yes
`checkingScopeBinding`	`rule 3`		`checkingResourceBinding`		yes
`checkingResourceBinding`	`rule 1`	`resourcesDiffer`	`invalid_target.consent_resource_mismatch`		yes
`checkingResourceBinding`	`rule 2`		`checkingStepUp`		yes
`checkingStepUp`	`rule 1`	`needsFreshLogin`	`parkingRequest`		yes
`checkingStepUp`	`rule 2`	`remember`	`savingConsent`		yes
`checkingStepUp`	`rule 3`		`mintingCode`		yes
`savingConsent`	`DONE`		`mintingCode`	`saveConsent`	yes
`savingConsent`	`FAIL.server`		`server_error.store`		yes
`mintingCode`	`DONE`		`recordingGrant`	`mintCode`	yes
`mintingCode`	`FAIL.server`		`server_error.store`		yes
`recordingGrant`	`DONE`		`code_issued`		yes
`recordingGrant`	`FAIL.server`		`server_error.store`		yes
`parkingRequest`	`rule 1`	`requestTooLarge`	`invalid_request.authorization_too_large`		yes
`parkingRequest`	`rule 2`	`noSession`	`sign_in_required.no_session`		yes
`parkingRequest`	`rule 3`	`staleSession`	`sign_in_required.stale_session`		yes
`parkingRequest`	`rule 4`	`accountDisabled`	`sign_in_required.account_disabled`		yes
`parkingRequest`	`rule 5`		`sign_in_required.fresh_login`		yes