How to represent both agent OBO human and agent OBO itself in COAZ mapping

[max-stytch]

4.3 says:

For autonomous agent use cases, the context MUST include the identity of the agent. At least one field of either the subject or the context MUST be derived from the token input variable via a CEL expression.

However, the same MCP tool can be invoked by both an autonomous agent and an agent acting on behalf of a user. The COAZ mapping is the same for all callers, though. Suggest removing the "For autonomous agent use cases" part and strengthening to "The context MUST include the identity of the agent".

Splitting from #483

[baboulebou]

It all depends on how you represent the delegation. The token.sub should always be the actual subject. In a User->Agent delegation case, you could for example use OAuth Token Exchange to populate an act claim containing the whole chain. The short answer is I think that delegations would use different claims or context than the actual Subject.