[Ecosystem] strongly identifiable clients can also act on behalf of a user and be piloted as well

3.2. Limiting access by client application states

In the case of a strongly identifiable server-side application, the authenticated agent and the client application are the same. The client application has its own identity that can be strongly authenticated. Alice chooses which data that client application’s identity can access, in the same way that she chooses which data Bob can access.

I see it describing only one of possible cases. Strongly identifiable server-side client can just as well act on behalf of user who delegated access to it in the same way as they would do it for weakly identifiable client.

When it comes to piloting, strongly identifiable server-side client would use solid client as part of that server-side application, it can still provide custom client-server api (eg. using actor pattern) for the interface used to pilot it by the user. That means that user can pilot strongly identifiable server-side clients just as they can pilot weakly identifiable clients.

Start with section 3.2, “Limiting access by client application,” and read the issue’s comment thread to understand the unresolved distinction between strongly identifiable clients and delegated user access. Done means the specification clearly covers both client-identity access and clients acting on behalf of a user, including piloting.