The old text said that the authorizer is expected to determine group
memberships when the authenticator does not. This not true. It is
allowed, but not expected --- and none of the standard authorizers do
it. I tried composing a brief correct statement about this, but the
reviews were mainly aghast that internal details of some non-standard
authorizers were being injected into the discussion of authentictors.
I decided that the better part of valor is simply to delete the whole
topic from here. Besides, it is a conclusion that any reader would
normally draw --- since there is no statement forbidding it (nor
indeed any indication that there might be a reason to forbid it), any
reader would naturally conclude that an authorizer is free to derive
additional intermediate information of any sort and in any way it
likes.
Mike Spreitzer
12f5e30309