Scope for single transaction authorizations

When a bank withdrawal needs to be authorized with an out of band credential, it is necessary to limit the scope of the authorization to the single transaction. Furthermore, the authorization ui must show information about the transaction.
In plain oauth2, the scope is used to describe what the authorization is for. How can an authorization endpoint display meaningful information about the single transaction and provide an access token for the single transaction which allows the protected resource to verify that the token is good for the incoming message which triggers the withdrawal? Can the transaction description and single transaction scope safely be passed to the authorization endpoint from the client as an authorization request parameter?

Start by reviewing the authorization endpoint, transaction description, single-transaction scope, and access-token requirements described in the issue. No files or tests are named, so clarify the protocol design and acceptance criteria before implementation; done should include a defined safe way to convey transaction details and verify that the token authorizes the triggering withdrawal.

Written by the indexing model from the issue text.