Yes, correct. You can basically already see this in solid-oidc, but I’m writing an official spec for it for OAuth, such that it can be referenced everywhere, rather than everyone implementing slightly different things
Also, fwiw, everything here was already discussed between myself and Aaron, I was hoping to get a draft up before announcing it, but as people were talking intent-to-implement, I wanted to warn that we’ll soon have a spec that solves a bunch of the problems