Resource Owner restricting their own access

I recall various conversations about scenarios where the user would like to restrict their own access. While specification doesn't seem to prevent Resource Owner from creating Social Agent registration for oneself. At least in sai-js, currently we don't check if it exists and if it does delegate those grants to applications rather than create direct data grants.

If we clarify use cases where such functionality is expected. We should at least mention them in the Authorization Agent primer and update implementations (at least sai-js).

Of course, being a Resource Owner one can always escalate one's own privilege, still in some scenarios having that chmod like step required can prevent some unexpected results.

Start by clarifying the use cases for a Resource Owner restricting their own access and review the Authorization Agent primer. Then inspect sai-js to determine how existing Social Agent registrations and delegated grants are handled. Done means the intended behavior is documented and the affected implementation is updated accordingly.