Summary

  • The IESG's 24 September agenda carries IANA action #1451183: find designated experts for three OAuth registries. Its action list says the item began on 30 April and had remained across ten telechats as of the 17 September update.
  • The 30 April minutes explicitly call for additional experts. The live IANA tables still name Justin Richer for all three; the record does not establish an empty seat, a stalled registry or a failed incumbent.
  • A defensible public test separates an IESG appointment, IANA's named-expert roster, a request's mailing-list review and the final registry entry. None of those records alone proves the others.

The word “needed” in an agenda heading compresses several different states. Read alone, it might suggest that nobody can review a proposed OAuth registration. The minutes of the meeting that created the action are more precise: the management item was for additional designated experts. In the current IANA OAuth Parameters registry, Justin Richer remains listed beside OAuth Dynamic Client Registration Metadata, OAuth Token Endpoint Authentication Methods and OAuth Token Introspection Response. The evidence therefore supports a plan to enlarge or reinforce review capacity, not a report that these three registries have no reviewer.

The three surfaces matter differently to implementers. Client-registration metadata names what a client can tell an authorization server at registration. The token-endpoint-authentication table names methods through which a client authenticates at that endpoint. The introspection-response table names fields intended for cross-domain use when a protected resource asks an authorization server about a token. A name appearing in one table does not silently authorize a name in another. Each table has its own entries, references and expert-facing review path.

The procedures are not merely decorative. RFC 7591 describes a two-week review on the OAuth extensions list and says IANA is to accept registry updates only from designated experts. RFC 7662 sets out the comparable boundary for introspection-response names. The public list is a place to submit and discuss a proposal; the expert decision is a distinct act; IANA's row is the durable publication of an accepted name. An editor should not convert “action item still open” into “all requests are waiting,” because the public agenda does not count requests or measure response times.

There is also no basis for blaming the named incumbent. One person appearing in three current tables is evidence about published responsibility, not about time available, work completed, conflict handling or future staffing. The ten-telechat age belongs to the IESG's appointment action. It is not a ten-telechat delay assigned to any applicant. That distinction is where this news sits: an institution can acknowledge the need for more review capacity while its public registry quite properly continues to name a current expert.

The practical question for the next public record is narrow. If the IESG approves an additional expert, which of the three tables change, when do those names appear, and how are live registration requests directed during the transition? A small appointment-to-registry crosswalk—decision date and scope, IANA roster revision, public request and review outcome where available—would make the handoff inspectable. This is editorial advice, not a new requirement imposed by the IESG or IANA.

Sources