How does authoritativeGroups work on first use and first RP login?

1. How will a user have a authoritativeGroups list added to their user.app_metadata object? It looks like in the absence of the list no check is done but I don't see how the list is created and added to the user's user.app_metadata in the first place.
2. Assuming the authoritativeGroups list exists in the user's user.app_metadata object, how are new RP objects added to the list? It looks like lastUsed values are updated if the RP already exists in authoritativeGroups but I don't see how, when a user first logs into an RP which has a expire_access_when_unused_after value, what creates a new object for that RP in the user's authoritativeGroups list.

Start with rules/AccessRules.js, especially the linked logic around lines 29-40, and trace where user.app_metadata is initialized or updated during first use and RP login. Check the repository's other Auth0 rules or hosted-page entry points for related metadata handling; done means documenting the lifecycle of authoritativeGroups and its RP entries.