Define responsibilities of Authorization Server

Today we discussed it during the call. I will write down high-level overview of how I see it. Later I will add how it may tie together to #222

Authorization Agent

associated with End-user, sometimes also acting as Resource Owner

• Records Access Authorizations (with Data Authorizations etc.)
• From above generates Access Grants (with Data Grants etc.)

Authorization Server

associated with Resource Server

• From Access Grants (with Data Grants) generates ACRs (ACP) / ACLs (WAC)

Resource Server

associated with Authorization Server (owned by a Resource Owner)

• enforces access based on ACRs (ACP) / ACLs (WAC) set by AS

We were also discussing how AS can access relevant Data Grants, including an option where AA would push that information to AS. We should elaborate more on that aspects. Data Grants are stored in Agent Registrations of grantees, I would like to consider that each AS gets Agent Registration as well and AA creates some specialized ??? Grants which grant AS access to Data Grants related to Data Registrations falling under the control of that AS. In that case, it would be a matter of using Solid Notifications for AS to subscribe to its agent registration. Other options should be evaluated as well.