{
  "slug": "rich-authorization-requests",
  "title": "OAuth learned to describe the transaction. It still cannot prove you meant it.",
  "summary": "RFC 9396 made OAuth scopes precise. Precision is not consent. Why a perfectly scoped token proves nothing about the human, and how to fix it.",
  "lede": "Rich Authorization Requests gave OAuth the vocabulary to say exactly what a token may do, down to the amount and the destination account. That was a real advance. It did nothing to change how the human's agreement was captured, which is still a click in a browser session.",
  "date": "2026-09-25",
  "reading_time": "17 min read",
  "category": "Standards",
  "tags": [
    "RFC 9396",
    "rich authorization requests",
    "OAuth consent",
    "DPoP",
    "dynamic linking",
    "agent authorization",
    "open banking"
  ],
  "image": "https://cdn.twc.sh/images/igcache/Rich%20Authorization%20Requests/1200_630/blog.jpg",
  "url": "/blog/rich-authorization-requests.html",
  "wordcount": 3636,
  "related": [
    "oauth-consent-persistence",
    "device-code-phishing",
    "passkeys-prove-login-not-transaction"
  ],
  "schema": "Article"
}