Delegated User Identity

Can a caller obtain a token scoped to the HUMAN it is acting for, or only a credential belonging to the integration itself? Section 10.3 of draft-klrc-aiagent-auth-00 splits exactly this way — the user delegates authorization, versus the agent obtains its own — and nothing in this rubric distinguished them. It is the difference between an audit log that can name a delegated subject and one that cannot, which Section 11 of that draft makes a MUST. DISTINCT FROM `auth_clarity` on purpose. A provider can hold strong bound credentials and still offer no delegation path, and the reverse is equally possible; scoring them as one dimension would let a strong answer to one question hide a missing answer to the other. MEASURED BEFORE IT WAS BUILT: 768 providers declare `authorizationCode`, ~67% of the 1,142 declaring any oauth2 and 20x the `openIdConnect` population. That discriminating power is what separates it from `agent_identity_declared`, which stays parked at 13 providers. ADDED AT SLOT 16, APPENDED. Dimension order is positional in DIM_ORDER and in the glyph; appending shifts nothing, inserting would shift every slot after it.