Protected Resource Metadata

RFC 9728. Section 10.9.2 of draft-klrc-aiagent-auth-00 — an agent discovers HOW a resource is protected and WHICH authorization server protects it, at runtime, instead of being configured by a human. It is the ONLY part of that draft's composition that is a fetchable artifact at the provider's own domain; WIMSE identifiers, attestation and Transaction Tokens all live inside provider infrastructure and cannot be observed from outside. `resource` is the required field. `authorization_servers` is what makes the document actionable — without it an agent learns the resource is protected but not by whom, which describes a lock and not the key. NOT PROBED BY STATUS CODE. api.slack.com answers 200 text/html to this path and to both OAuth metadata paths — a docs-site catch-all — so a status probe would award full credit three times over to a provider serving none of them. The saved BODY is read and the required field tested.