From 99d9155e6f135c7ceda36cbb21bf28af9b739df3 Mon Sep 17 00:00:00 2001 From: Max Date: Sat, 15 Aug 2026 11:45:19 -0400 Subject: [PATCH] docs(nip-fi): require domain and issuer separation Co-authored-by: Max Signed-off-by: Max --- docs/nips/NIP-FI.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/docs/nips/NIP-FI.md b/docs/nips/NIP-FI.md index 8bfa34d441..1d1889ea73 100644 --- a/docs/nips/NIP-FI.md +++ b/docs/nips/NIP-FI.md @@ -54,6 +54,11 @@ public identity projection, application membership policy, or user interface. - **lease**: a cached committed decision for one actor and bounded operation set. A lease is not a binding. +Identity and authorization-state comparisons preserve every tuple component. +Equal `sub` values under different `iss` values are distinct identities; equal +`(i, k)` pairs under different domains are distinct bindings, retired pairs, +and authorization state. [FI-TRACE-CROSS-DOMAIN-COLLISION] + Every identifier is either **interoperability-critical** or **deployment-local**. Header names, public response bytes, token type values, and trace identifiers are interoperability-critical and fixed here.