Formalize scope intersection and introspection response fields

[jpelaez-23blocks]

Summary

• Scope Resolution section — defines MUST behavior for scope intersection when agents request specific scopes. Prevents scope escalation, enables least-privilege token requests.
• Required Introspection Fields table — makes agent-specific fields (agent_id, agent_address, agent_name, agent_role, agent_status) normative with MUST/SHOULD requirements. Enables target APIs to make identity-aware authorization decisions.

Both additions are non-breaking. They formalize behavior that the reference implementation (23blocks Auth API) already enforces in production.

Motivation

After building a full AID implementation end-to-end (registration, token exchange, introspection, lifecycle management, and a production frontend), we identified two areas where the spec was informational but should be normative:

1. What happens when an agent requests scopes it doesn't have? The spec showed scope as a parameter but didn't define the intersection/rejection behavior.
2. The introspection response included agent fields in an example but didn't specify them as required. Without normative field names, different auth server implementations could return different shapes, breaking interoperability.

Test plan

• Verify scope resolution section is clear and unambiguous
• Verify introspection field table matches reference implementation output
• Confirm no breaking changes to existing spec sections

🤖 Generated with Claude Code