Authority Conformance Tests — AU10

Test matrix (sample)

ID	Flow	Binding	Expected	Metric	Fixture
CT-001	device_code	DPoP P-256	nonce required; TTL 120s; aud exact	delegations_per_tenant_1h	fixtures/device-code-dpop.json
CT-002	auth_code	mTLS	SAN matches client_id; aud strict; PKCE	delegation_failures_5m	fixtures/auth-code-mtls.json
CT-003	client_credentials	DPoP Ed25519	tenant claim required; multi-aud rejected	delegated_token_duration_seconds_p99	fixtures/client-cred-dpop.json
CT-004	revocation	any	revocation freshness ≤600s; JWKS rotated	jwks_freshness_seconds	fixtures/revocation.json
CT-005	ABAC precedence	n/a	ABAC precedence < RBAC; denies override	abac_precedence_checks	fixtures/abac.json

delegations_per_tenant_1h, delegation_failures_5m, delegated_token_duration_seconds_p99, jwks_freshness_seconds, abac_precedence_checks.
Alerts mirror delegation quotas (see AU8) and revocation freshness.

Deterministic harness: run tests against offline kit verifier bundle; log NDJSON with UTC timestamps; hash results into SHA256SUMS when produced.