RFC 9396 Rich Authorization Requests: more than a scope
Rich Authorization Requests extend OAuth with structured authorization_details: instead of a coarse scope like payments, the request describes exactly what should be allowed — type, amount, recipient. This lets an access token carry real authority.
The principle
The client requests a token with a JSON object describing the desired permission; the authorisation server issues the token with exactly these details, the resource server checks them.
At Mandact
A bridge that wrote the mandate’s action type and limits into access tokens as authorization_details was built — and is withdrawn (410 Gone): tokens in process memory and a missing tenant binding would not have carried the promise. Today the mandate is presented via OID4VP or checked via /v1/verify.
The lesson
A token with embedded authority stays valid until expiry if nobody asks live. Mandates therefore always need a live status check — at Mandact via /v1/verify and the Token Status List.
Status
Explains the standard; the Mandact bridge for it is withdrawn (410 Gone).