{"id":121255,"date":"2026-11-02T11:25:48","date_gmt":"2026-11-02T03:25:48","guid":{"rendered":"https:\/\/www.wsisp.com\/helps\/121255.html"},"modified":"2026-11-02T11:25:48","modified_gmt":"2026-11-02T03:25:48","slug":"%e7%ac%ac-5-%e7%af%87%ef%bd%9cauthz%ef%bc%88%e4%b8%80%ef%bc%89%ef%bc%9a%e6%9d%83%e9%99%90%e6%a8%a1%e5%9e%8b-%e4%bb%8e-scope-%e5%88%b0-rich-authorization-requests","status":"publish","type":"post","link":"https:\/\/www.wsisp.com\/helps\/121255.html","title":{"rendered":"\u7b2c 5 \u7bc7\uff5cAuthZ\uff08\u4e00\uff09\uff1a\u6743\u9650\u6a21\u578b\u2014\u2014\u4ece scope \u5230 Rich Authorization Requests"},"content":{"rendered":"

\u7cfb\u5217：\u300a\u8ba9 AI \u66ff\u4f60\u529e\u94f6\u884c\u4e1a\u52a1：\u9762\u5411 MCP Connector \u7684\u8eab\u4efd\u8ba4\u8bc1\u4e0e\u6388\u6743\u8bbe\u8ba1\u300b \u89c4\u8303\u57fa\u7ebf：MCP 2026-07-28（Scope Selection Strategy\u3001Scope Challenge Handling）；RFC 6749 \u00a73.3；RFC 6750 \u00a73.1；RFC 9396 \u64b0\u5199\u65e5\u671f：2026-10-23<\/p>\n

\n

0. \u4e00\u53e5\u8bdd\u6388\u6743<\/h3>\n

\u7528\u6237\u5bf9 AI \u8bf4：\u300c\u4ee5\u540e\u6bcf\u4e2a\u6708\u5e2e\u6211\u7ed9\u7269\u4e1a\u4ea4\u7ba1\u7406\u8d39，\u4ece\u50a8\u84c4\u6237\u6263，\u6bcf\u6b21\u4e0d\u8d85\u8fc7 2,000 \u6e2f\u5143\u3002\u300d<\/p>\n

\u7ffb\u8bd1\u6210\u6388\u6743，\u81f3\u5c11\u5305\u542b\u4e94\u4e2a\u7ef4\u5ea6：<\/p>\n\n\u7ef4\u5ea6\u8fd9\u53e5\u8bdd\u91cc\u7684\u503c<\/tr>\n\n\n\n\n\n\n
\u8d44\u6e90<\/td>\n\u652f\u4ed8<\/td>\n<\/tr>\n
\u64cd\u4f5c<\/td>\n\u8d77\u8349（\u4e0d\u662f\u6267\u884c，\u89c1\u7b2c 2 \u7bc7）<\/td>\n<\/tr>\n
\u8d26\u6237<\/td>\n\u50a8\u84c4\u6237 acc_7Hq2<\/td>\n<\/tr>\n
\u91d1\u989d\u4e0a\u9650<\/td>\n\u6bcf\u7b14 HK$2,000<\/td>\n<\/tr>\n
\u6709\u6548\u671f<\/td>\n\u82e5\u5e72\u4e2a\u6708（\u94f6\u884c\u653f\u7b56\u53ef\u80fd\u518d\u6536\u7d27）<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\u8fd8\u9690\u542b\u7b2c\u516d\u4e2a\u7ef4\u5ea6：\u6536\u6b3e\u4eba\u2014\u2014\u53ea\u9650\u7269\u4e1a\u7ba1\u7406\u5904\u3002<\/p>\n

\u672c\u7bc7\u8ba8\u8bba\u8fd9\u4e9b\u7ef4\u5ea6\u5e94\u8be5\u5206\u522b\u653e\u5728\u54ea\u91cc：\u54ea\u4e9b\u8fdb scope，\u54ea\u4e9b\u8fdb Rich Authorization Requests（RAR，RFC 9396），\u54ea\u4e9b\u7559\u5728\u670d\u52a1\u7aef\u53f0\u8d26\u91cc\u3002<\/p>\n

\n

1. scope \u64c5\u957f\u4ec0\u4e48\u3001\u4e0d\u64c5\u957f\u4ec0\u4e48<\/h3>\n

RFC 6749 \u00a73.3 \u5bf9 scope \u7684\u5b9a\u4e49\u5f88\u6734\u7d20：\u4e00\u4e2a\u4ee5\u7a7a\u683c\u5206\u9694\u3001\u5927\u5c0f\u5199\u654f\u611f\u7684\u5b57\u7b26\u4e32\u5217\u8868，\u542b\u4e49\u7531\u6388\u6743\u670d\u52a1\u5668\u5b9a\u4e49\u3002\u5b83\u6ca1\u6709\u7ed3\u6784\u3002<\/p>\n

\u628a\u4e94\u4e2a\u7ef4\u5ea6\u90fd\u585e\u8fdb scope，\u4f1a\u5f97\u5230\u8fd9\u6837\u7684\u4e1c\u897f：<\/p>\n

payments:draft:acc_7Hq2:payee=pay_Cd34:max=2000HKD:until=2026-12-31<\/p>\n

\u95ee\u9898\u5f88\u660e\u663e：<\/p>\n

    \n
  • \u7ec4\u5408\u7206\u70b8：\u8d26\u6237\u6570 \u00d7 \u6536\u6b3e\u4eba\u6570 \u00d7 \u91d1\u989d\u6863\u4f4d \u00d7 \u6709\u6548\u671f，\u6ca1\u6cd5\u4e8b\u5148\u5728 scopes_supported \u91cc\u5217\u4e3e；<\/li>\n
  • \u8bed\u4e49\u4e0d\u53ef\u6821\u9a8c：\u6388\u6743\u670d\u52a1\u5668\u548c\u8d44\u6e90\u670d\u52a1\u5668\u90fd\u5f97\u81ea\u5df1\u89e3\u6790\u8fd9\u4e32\u5b57\u7b26，\u4efb\u4f55\u4e00\u65b9\u89e3\u6790\u4e0d\u4e00\u81f4\u5c31\u662f\u6f0f\u6d1e；<\/li>\n
  • \u540c\u610f\u9875\u96be\u4ee5\u6e32\u67d3：\u7528\u6237\u770b\u5230\u7684\u8981\u4e48\u662f\u8fd9\u4e32\u5b57\u7b26，\u8981\u4e48\u662f\u5404\u65b9\u5404\u81ea\u7ffb\u8bd1\u7684\u6587\u6848；<\/li>\n
  • \u8fdd\u80cc MCP \u7684\u589e\u91cf\u6388\u6743\u8bbe\u8ba1：MCP \u89c4\u5b9a\u5ba2\u6237\u7aef\u5728\u589e\u91cf\u6388\u6743\u65f6，\u8981\u628a\u4e4b\u524d\u7533\u8bf7\u8fc7\u7684 scope \u4e0e\u65b0\u6311\u6218\u7684 scope \u53d6\u5e76\u96c6\u3002\u52a8\u6001 scope \u4f1a\u8ba9\u8fd9\u4e2a\u5e76\u96c6\u8d8a\u6eda\u8d8a\u5927\u3002<\/li>\n<\/ul>\n

    \u6240\u4ee5\u5206\u5de5\u662f：<\/p>\n

      \n
    • scope \u53ea\u8868\u8fbe\u300c\u8d44\u6e90 \u00d7 \u64cd\u4f5c\u300d，\u662f\u4e00\u4e2a\u7c97\u7c92\u5ea6\u3001\u53ef\u679a\u4e3e\u3001\u53ef\u5728 scopes_supported \u516c\u5e03\u7684\u8bcd\u8868；<\/li>\n
    • RAR \u8868\u8fbe\u8d26\u6237\u3001\u6536\u6b3e\u4eba\u3001\u91d1\u989d\u3001\u6709\u6548\u671f\u7b49\u7ed3\u6784\u5316\u7ea6\u675f；<\/li>\n
    • \u670d\u52a1\u7aef\u53f0\u8d26\u8bb0\u5f55\u6d88\u8017（\u4f8b\u5982\u672c\u6388\u6743\u4e0b\u5df2\u7ecf\u8d77\u8349\u4e86\u591a\u5c11\u94b1）\u2014\u2014token \u53ea\u80fd\u8868\u8fbe\u4e0a\u9650，\u8868\u8fbe\u4e0d\u4e86\u7528\u4e86\u591a\u5c11\u3002<\/li>\n<\/ul>\n

      #mermaid-svg-kYxsXyUf2hBnVyek{font-family:\\”trebuchet ms\\”,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-kYxsXyUf2hBnVyek .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-kYxsXyUf2hBnVyek .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-kYxsXyUf2hBnVyek .error-icon{fill:#552222;}#mermaid-svg-kYxsXyUf2hBnVyek .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-kYxsXyUf2hBnVyek .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-kYxsXyUf2hBnVyek .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-kYxsXyUf2hBnVyek .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-kYxsXyUf2hBnVyek .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-kYxsXyUf2hBnVyek .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-kYxsXyUf2hBnVyek .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-kYxsXyUf2hBnVyek .marker{fill:#333333;stroke:#333333;}#mermaid-svg-kYxsXyUf2hBnVyek .marker.cross{stroke:#333333;}#mermaid-svg-kYxsXyUf2hBnVyek svg{font-family:\\”trebuchet ms\\”,verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-kYxsXyUf2hBnVyek p{margin:0;}#mermaid-svg-kYxsXyUf2hBnVyek .label{font-family:\\”trebuchet ms\\”,verdana,arial,sans-serif;color:#333;}#mermaid-svg-kYxsXyUf2hBnVyek .cluster-label text{fill:#333;}#mermaid-svg-kYxsXyUf2hBnVyek .cluster-label span{color:#333;}#mermaid-svg-kYxsXyUf2hBnVyek .cluster-label span p{background-color:transparent;}#mermaid-svg-kYxsXyUf2hBnVyek .label text,#mermaid-svg-kYxsXyUf2hBnVyek span{fill:#333;color:#333;}#mermaid-svg-kYxsXyUf2hBnVyek .node rect,#mermaid-svg-kYxsXyUf2hBnVyek .node circle,#mermaid-svg-kYxsXyUf2hBnVyek .node ellipse,#mermaid-svg-kYxsXyUf2hBnVyek .node polygon,#mermaid-svg-kYxsXyUf2hBnVyek .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#mermaid-svg-kYxsXyUf2hBnVyek .rough-node .label text,#mermaid-svg-kYxsXyUf2hBnVyek .node .label text,#mermaid-svg-kYxsXyUf2hBnVyek .image-shape .label,#mermaid-svg-kYxsXyUf2hBnVyek .icon-shape .label{text-anchor:middle;}#mermaid-svg-kYxsXyUf2hBnVyek .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#mermaid-svg-kYxsXyUf2hBnVyek .rough-node .label,#mermaid-svg-kYxsXyUf2hBnVyek .node .label,#mermaid-svg-kYxsXyUf2hBnVyek .image-shape .label,#mermaid-svg-kYxsXyUf2hBnVyek .icon-shape .label{text-align:center;}#mermaid-svg-kYxsXyUf2hBnVyek .node.clickable{cursor:pointer;}#mermaid-svg-kYxsXyUf2hBnVyek .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#mermaid-svg-kYxsXyUf2hBnVyek .arrowheadPath{fill:#333333;}#mermaid-svg-kYxsXyUf2hBnVyek .edgePath .path{stroke:#333333;stroke-width:2.0px;}#mermaid-svg-kYxsXyUf2hBnVyek .flowchart-link{stroke:#333333;fill:none;}#mermaid-svg-kYxsXyUf2hBnVyek .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-kYxsXyUf2hBnVyek .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#mermaid-svg-kYxsXyUf2hBnVyek .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-kYxsXyUf2hBnVyek .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#mermaid-svg-kYxsXyUf2hBnVyek .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#mermaid-svg-kYxsXyUf2hBnVyek .cluster text{fill:#333;}#mermaid-svg-kYxsXyUf2hBnVyek .cluster span{color:#333;}#mermaid-svg-kYxsXyUf2hBnVyek div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:\\”trebuchet ms\\”,verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#mermaid-svg-kYxsXyUf2hBnVyek .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#mermaid-svg-kYxsXyUf2hBnVyek rect.text{fill:none;stroke-width:0;}#mermaid-svg-kYxsXyUf2hBnVyek .icon-shape,#mermaid-svg-kYxsXyUf2hBnVyek .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-kYxsXyUf2hBnVyek .icon-shape p,#mermaid-svg-kYxsXyUf2hBnVyek .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#mermaid-svg-kYxsXyUf2hBnVyek .icon-shape .label rect,#mermaid-svg-kYxsXyUf2hBnVyek .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-kYxsXyUf2hBnVyek .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#mermaid-svg-kYxsXyUf2hBnVyek .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#mermaid-svg-kYxsXyUf2hBnVyek :root{–mermaid-font-family:\\”trebuchet ms\\”,verdana,arial,sans-serif;}<\/p>\n

      <\/p>\n

      \u94f6\u884c\u670d\u52a1\u7aef<\/p>\n

      <\/span><\/p>\n

      <\/p>\n

      access token<\/p>\n

      <\/span><\/p>\n

      <\/p>\n

      \u80fd\u4e0d\u80fd\u8c03\u8fd9\u4e2a\u5de5\u5177<\/p>\n

      <\/span><\/p>\n

      <\/p>\n

      \u8fd9\u6b21\u53c2\u6570\u5728\u4e0d\u5728\u8303\u56f4\u5185<\/p>\n

      <\/span><\/p>\n

      <\/span><\/p>\n

      <\/span><\/p>\n

      <\/p>\n

      \u6388\u6743\u4ecd\u6709\u6548？<\/p>\n

      <\/span><\/p>\n

      <\/p>\n

      \u52a0\u4e0a\u672c\u7b14\u662f\u5426\u8d85\u7d2f\u8ba1\u4e0a\u9650？<\/p>\n

      <\/span><\/p>\n

      <\/p>\n

      scope\u8d44\u6e90 \u00d7 \u64cd\u4f5cpayments:draft<\/p>\n

      <\/span><\/p>\n

      <\/p>\n

      authorization_details（RAR）\u8d26\u6237 \u00b7 \u6536\u6b3e\u4eba\u7ea6\u675f \u00b7 \u5355\u7b14\/\u7d2f\u8ba1\u4e0a\u9650 \u00b7 \u6709\u6548\u671f<\/p>\n

      <\/span><\/p>\n

      <\/p>\n

      grant_id<\/p>\n

      <\/span><\/p>\n

      <\/p>\n

      \u53f0\u8d26：\u672c\u6388\u6743\u4e0b\u5df2\u8d77\u8349\u91d1\u989d<\/p>\n

      <\/span><\/p>\n

      <\/p>\n

      \u6388\u6743\u767b\u8bb0\u518c：\u72b6\u6001（\u6709\u6548 \/ \u5df2\u64a4\u9500）<\/p>\n

      <\/span><\/p>\n

      <\/p>\n

      MCP server \u5224\u5b9a<\/p>\n

      <\/span><\/p>\n

      \n

      2. ExampleBank \u7684 scope \u8bcd\u8868<\/h3>\n\nscope\u7b49\u7ea7\u5bf9\u5e94\u5de5\u5177\u8bf4\u660e<\/tr>\n\n\n\n\n\n\n\n\n
      accounts:read<\/td>\nL0<\/td>\nlist_accounts<\/td>\n\u57fa\u7840\u96c6，\u51fa\u73b0\u5728 401 \u6311\u6218\u4e0e scopes_supported<\/td>\n<\/tr>\n
      transactions:read<\/td>\nL0<\/td>\nlist_transactions<\/td>\n\u57fa\u7840\u96c6<\/td>\n<\/tr>\n
      cards:read<\/td>\nL0<\/td>\nlist_cards（\u793a\u4f8b\u4ee3\u7801\u672a\u5b9e\u73b0）<\/td>\n<\/td>\n<\/tr>\n
      alerts:write<\/td>\nL1<\/td>\ncreate_alert（\u793a\u4f8b\u4ee3\u7801\u672a\u5b9e\u73b0）<\/td>\n\u53ea\u80fd\u65b0\u589e，\u4e0d\u80fd\u5220\u9664（\u7b2c 2 \u7bc7）<\/td>\n<\/tr>\n
      budgets:write<\/td>\nL1<\/td>\nset_budget（\u793a\u4f8b\u4ee3\u7801\u672a\u5b9e\u73b0）<\/td>\n<\/td>\n<\/tr>\n
      cards:freeze<\/td>\nL1<\/td>\nfreeze_card<\/td>\n\u53ea\u6709\u51bb\u7ed3，\u6ca1\u6709\u89e3\u51bb<\/td>\n<\/tr>\n
      payments:draft<\/td>\nL2<\/td>\ncreate_payment_draft \u7b49<\/td>\n\u5fc5\u987b\u4f34\u968f RAR<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

      \u8bbe\u8ba1\u539f\u5219：<\/p>\n

    • \u6ca1\u6709\u901a\u914d\u7b26，\u6ca1\u6709 *:execute\u3002 \u8bcd\u8868\u91cc\u523b\u610f\u4e0d\u5b58\u5728 payments:write\u3001cards:unfreeze\u3001banking:full\u3002\u8fd9\u4e0d\u662f\u300c\u6682\u65f6\u6ca1\u505a\u300d，\u800c\u662f\u5199\u8fdb\u8bbe\u8ba1\u6587\u6863\u7684\u300c\u4e0d\u505a\u300d\u3002<\/li>\n
    • \u547d\u540d \u8d44\u6e90:\u64cd\u4f5c，\u64cd\u4f5c\u7528\u4e1a\u52a1\u52a8\u8bcd（draft\u3001freeze），\u800c\u4e0d\u662f CRUD（write\u3001delete）\u3002CRUD \u52a8\u8bcd\u4f1a\u8bf1\u5bfc\u5bf9\u79f0\u8bbe\u8ba1\u3002<\/li>\n
    • \u57fa\u7840\u96c6\u53ea\u542b L0\u3002 \u56de\u987e\u7b2c 3 \u7bc7：401 \u672a\u7ed9\u51fa scope \u65f6，\u5ba2\u6237\u7aef\u4f1a\u7533\u8bf7 scopes_supported \u4e2d\u7684\u5168\u90e8 scope\u3002MCP \u5b89\u5168\u6700\u4f73\u5b9e\u8df5\u4e5f\u628a\u300c\u5728 scopes_supported \u4e2d\u516c\u5e03\u6240\u6709\u53ef\u80fd\u7684 scope\u300d\u5217\u4e3a\u5e38\u89c1\u9519\u8bef\u3002<\/li>\n
    • \u5982\u679c\u5f15\u5165\u5c42\u7ea7 scope，\u670d\u52a1\u7aef\u5fc5\u987b\u5904\u7406\u8574\u542b\u5173\u7cfb\u3002 MCP \u89c4\u5b9a\u670d\u52a1\u7aef\u5224\u65ad token \u662f\u5426\u8db3\u591f\u65f6 MUST \u8003\u8651 scope \u5c42\u7ea7\u3002ExampleBank \u4e0d\u5f15\u5165\u5c42\u7ea7，\u5224\u65ad\u5c31\u662f\u7b80\u5355\u7684\u5305\u542b\u5173\u7cfb（hasScope）\u3002<\/li>\n

      \u8d26\u6237\u9009\u62e9\u653e\u5728\u54ea？ \u7528\u6237\u5728\u540c\u610f\u9875\u4e0a\u52fe\u9009\u300c\u5141\u8bb8 AI \u8bbf\u95ee\u54ea\u4e9b\u8d26\u6237\u300d\u3002\u8fd9\u4e2a\u9009\u62e9\u5b58\u5165\u6388\u6743\u767b\u8bb0\u518c，\u800c\u4e0d\u662f\u5199\u8fdb\u5916\u90e8 token：<\/p>\n

        \n
      • \u5916\u90e8 token \u53ea\u6709 grant_id；<\/li>\n
      • MCP server \u901a\u8fc7 Token Exchange（\u7b2c 6 \u7bc7）\u6362\u53d6\u5185\u90e8 token \u65f6，\u5185\u90e8 STS \u6839\u636e grant_id \u628a\u53ef\u8bbf\u95ee\u8d26\u6237\u5199\u8fdb\u5185\u90e8 token；<\/li>\n
      • \u5185\u90e8 API \u636e\u6b64\u8fc7\u6ee4\u3002<\/li>\n<\/ul>\n

        \u8fd9\u6837\u505a\u7684\u597d\u5904\u662f：\u8d26\u6237\u6e05\u5355\u4e0d\u51fa\u73b0\u5728 AI \u5e73\u53f0\u4fdd\u5b58\u7684 token \u91cc；\u7528\u6237\u5728 App \u4e2d\u53d6\u6d88\u67d0\u4e2a\u8d26\u6237\u7684\u6388\u6743，\u4e0b\u4e00\u6b21 Token Exchange \u7acb\u5373\u751f\u6548，\u65e0\u9700\u7b49\u5916\u90e8 token \u8fc7\u671f\u3002<\/p>\n

        \n

        3. RAR：RFC 9396 \u901f\u89c8<\/h3>\n

        RFC 9396 \u5728 OAuth \u6388\u6743\u8bf7\u6c42\u4e2d\u5f15\u5165 authorization_details \u53c2\u6570：\u4e00\u4e2a JSON \u6570\u7ec4，\u6bcf\u4e2a\u5143\u7d20\u662f\u4e00\u4e2a\u5bf9\u8c61，\u5fc5\u987b\u6709 type \u5b57\u6bb5，\u5176\u4f59\u5b57\u6bb5\u7531\u8be5 type \u5b9a\u4e49\u3002RFC \u8fd8\u5b9a\u4e49\u4e86\u51e0\u4e2a\u901a\u7528\u5b57\u6bb5：<\/p>\n\n\u5b57\u6bb5\u542b\u4e49<\/tr>\n\n\n\n\n\n\n\n
        type<\/td>\n\u6388\u6743\u8be6\u60c5\u7c7b\u578b（\u5fc5\u586b）<\/td>\n<\/tr>\n
        locations<\/td>\n\u53ef\u4ee5\u5728\u54ea\u4e9b\u8d44\u6e90\u670d\u52a1\u5668\u4e0a\u4f7f\u7528<\/td>\n<\/tr>\n
        actions<\/td>\n\u5141\u8bb8\u7684\u52a8\u4f5c<\/td>\n<\/tr>\n
        datatypes<\/td>\n\u53ef\u8bbf\u95ee\u7684\u6570\u636e\u7c7b\u578b<\/td>\n<\/tr>\n
        identifier<\/td>\n\u5177\u4f53\u8d44\u6e90\u7684\u6807\u8bc6<\/td>\n<\/tr>\n
        privileges<\/td>\n\u6743\u9650\u7ea7\u522b<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

        \u6388\u6743\u670d\u52a1\u5668\u5728\u5143\u6570\u636e\u4e2d\u7528 authorization_details_types_supported \u58f0\u660e\u652f\u6301\u54ea\u4e9b\u7c7b\u578b；token \u54cd\u5e94\u4f1a\u628a\u6700\u7ec8\u6388\u4e88\u7684 authorization_details \u8fd4\u56de\u7ed9\u5ba2\u6237\u7aef，JWT access token \u4e2d\u4e5f\u53ef\u4ee5\u643a\u5e26\u540c\u540d claim\u3002<\/p>\n

        3.1 ExampleBank \u7684\u652f\u4ed8\u8349\u7a3f\u7c7b\u578b<\/h4>\n

        {<\/span>
        \n "type"<\/span>:<\/span> "https:\/\/examplebank.hk\/rar\/payment-draft\/v1"<\/span>,<\/span>
        \n "actions"<\/span>:<\/span> [<\/span>"create_draft"<\/span>]<\/span>,<\/span>
        \n "locations"<\/span>:<\/span> [<\/span>"https:\/\/mcp.examplebank.hk\/mcp"<\/span>]<\/span>,<\/span>
        \n "debtor_account_ref"<\/span>:<\/span> "acc_7Hq2"<\/span>,<\/span>
        \n "creditor_constraint"<\/span>:<\/span> {<\/span> "mode"<\/span>:<\/span> "listed"<\/span>,<\/span> "payee_refs"<\/span>:<\/span> [<\/span>"pay_Cd34"<\/span>]<\/span> }<\/span>,<\/span>
        \n "instructed_amount_limit"<\/span>:<\/span> {<\/span>
        \n "currency"<\/span>:<\/span> "HKD"<\/span>,<\/span>
        \n "per_transaction"<\/span>:<\/span> "2000.00"<\/span>,<\/span>
        \n "cumulative"<\/span>:<\/span> "6000.00"<\/span>
        \n }<\/span>,<\/span>
        \n "valid_until"<\/span>:<\/span> "2026-11-22T00:00:00Z"<\/span>
        \n}<\/span><\/p>\n

        \u8bbe\u8ba1\u8981\u70b9：<\/p>\n

          \n
        • type \u7528\u94f6\u884c\u57df\u540d\u4e0b\u7684 URI \u5e76\u5e26\u7248\u672c\u53f7，\u65e5\u540e\u4fee\u6539\u7ed3\u6784\u65f6\u65b0\u589e \/v2，\u4e0d\u6539\u65e7\u7c7b\u578b\u7684\u8bed\u4e49；<\/li>\n
        • actions \u53ea\u6709 create_draft\u3002\u6388\u6743\u670d\u52a1\u5668\u6536\u5230\u5305\u542b\u4efb\u4f55\u6267\u884c\u7c7b\u52a8\u4f5c\u7684\u7533\u8bf7，\u76f4\u63a5\u62d2\u7edd，\u800c\u4e0d\u662f\u6084\u6084\u5220\u6389\u2014\u2014\u6084\u6084\u5220\u6389\u4f1a\u8ba9\u5ba2\u6237\u7aef\u8bef\u4ee5\u4e3a\u62ff\u5230\u4e86\u6267\u884c\u6743；<\/li>\n
        • locations \u4e0e RFC 8707 \u7684 resource \u4e00\u81f4，\u786e\u4fdd\u8fd9\u6761\u6388\u6743\u53ea\u80fd\u5728\u94f6\u884c MCP server \u4e0a\u4f7f\u7528；<\/li>\n
        • \u91d1\u989d\u7528\u5341\u8fdb\u5236\u5b57\u7b26\u4e32，\u4e0d\u7528\u6d6e\u70b9\u6570；<\/li>\n
        • \u6536\u6b3e\u4eba\u53ea\u7528\u94f6\u884c\u5185\u90e8\u5f15\u7528（pay_Cd34），\u4e0d\u51fa\u73b0\u771f\u5b9e\u8d26\u53f7\u3002<\/li>\n<\/ul>\n

          3.2 JSON Schema<\/h4>\n

          {<\/span>
          \n "$schema"<\/span>:<\/span> "https:\/\/json-schema.org\/draft\/2020-12\/schema"<\/span>,<\/span>
          \n "$id"<\/span>:<\/span> "https:\/\/examplebank.hk\/rar\/payment-draft\/v1\/schema.json"<\/span>,<\/span>
          \n "type"<\/span>:<\/span> "object"<\/span>,<\/span>
          \n "required"<\/span>:<\/span> [<\/span>"type"<\/span>,<\/span> "actions"<\/span>,<\/span> "locations"<\/span>,<\/span> "debtor_account_ref"<\/span>,<\/span> "creditor_constraint"<\/span>,<\/span> "instructed_amount_limit"<\/span>,<\/span> "valid_until"<\/span>]<\/span>,<\/span>
          \n "additionalProperties"<\/span>:<\/span> false<\/span>,<\/span>
          \n "properties"<\/span>:<\/span> {<\/span>
          \n "type"<\/span>:<\/span> {<\/span> "const"<\/span>:<\/span> "https:\/\/examplebank.hk\/rar\/payment-draft\/v1"<\/span> }<\/span>,<\/span>
          \n "actions"<\/span>:<\/span> {<\/span> "type"<\/span>:<\/span> "array"<\/span>,<\/span> "items"<\/span>:<\/span> {<\/span> "const"<\/span>:<\/span> "create_draft"<\/span> }<\/span>,<\/span> "minItems"<\/span>:<\/span> 1<\/span>,<\/span> "maxItems"<\/span>:<\/span> 1<\/span> }<\/span>,<\/span>
          \n "locations"<\/span>:<\/span> {<\/span> "type"<\/span>:<\/span> "array"<\/span>,<\/span> "items"<\/span>:<\/span> {<\/span> "type"<\/span>:<\/span> "string"<\/span>,<\/span> "format"<\/span>:<\/span> "uri"<\/span> }<\/span>,<\/span> "minItems"<\/span>:<\/span> 1<\/span> }<\/span>,<\/span>
          \n "debtor_account_ref"<\/span>:<\/span> {<\/span> "type"<\/span>:<\/span> "string"<\/span>,<\/span> "pattern"<\/span>:<\/span> "^acc_[A-Za-z0-9]{4,32}$"<\/span> }<\/span>,<\/span>
          \n "creditor_constraint"<\/span>:<\/span> {<\/span>
          \n "oneOf"<\/span>:<\/span> [<\/span>
          \n {<\/span> "type"<\/span>:<\/span> "object"<\/span>,<\/span> "required"<\/span>:<\/span> [<\/span>"mode"<\/span>]<\/span>,<\/span> "additionalProperties"<\/span>:<\/span> false<\/span>,<\/span>
          \n "properties"<\/span>:<\/span> {<\/span> "mode"<\/span>:<\/span> {<\/span> "const"<\/span>:<\/span> "registered_payees_only"<\/span> }<\/span> }<\/span> }<\/span>,<\/span>
          \n {<\/span> "type"<\/span>:<\/span> "object"<\/span>,<\/span> "required"<\/span>:<\/span> [<\/span>"mode"<\/span>,<\/span> "payee_refs"<\/span>]<\/span>,<\/span> "additionalProperties"<\/span>:<\/span> false<\/span>,<\/span>
          \n "properties"<\/span>:<\/span> {<\/span> "mode"<\/span>:<\/span> {<\/span> "const"<\/span>:<\/span> "listed"<\/span> }<\/span>,<\/span>
          \n "payee_refs"<\/span>:<\/span> {<\/span> "type"<\/span>:<\/span> "array"<\/span>,<\/span> "items"<\/span>:<\/span> {<\/span> "type"<\/span>:<\/span> "string"<\/span>,<\/span> "pattern"<\/span>:<\/span> "^pay_[A-Za-z0-9]{4,32}$"<\/span> }<\/span>,<\/span> "minItems"<\/span>:<\/span> 1<\/span>,<\/span> "maxItems"<\/span>:<\/span> 10<\/span> }<\/span> }<\/span> }<\/span>
          \n ]<\/span>
          \n }<\/span>,<\/span>
          \n "instructed_amount_limit"<\/span>:<\/span> {<\/span>
          \n "type"<\/span>:<\/span> "object"<\/span>,<\/span> "required"<\/span>:<\/span> [<\/span>"currency"<\/span>,<\/span> "per_transaction"<\/span>,<\/span> "cumulative"<\/span>]<\/span>,<\/span> "additionalProperties"<\/span>:<\/span> false<\/span>,<\/span>
          \n "properties"<\/span>:<\/span> {<\/span>
          \n "currency"<\/span>:<\/span> {<\/span> "const"<\/span>:<\/span> "HKD"<\/span> }<\/span>,<\/span>
          \n "per_transaction"<\/span>:<\/span> {<\/span> "type"<\/span>:<\/span> "string"<\/span>,<\/span> "pattern"<\/span>:<\/span> "^\\\\\\\\d{1,12}(\\\\\\\\.\\\\\\\\d{1,2})?$"<\/span> }<\/span>,<\/span>
          \n "cumulative"<\/span>:<\/span> {<\/span> "type"<\/span>:<\/span> "string"<\/span>,<\/span> "pattern"<\/span>:<\/span> "^\\\\\\\\d{1,12}(\\\\\\\\.\\\\\\\\d{1,2})?$"<\/span> }<\/span>
          \n }<\/span>
          \n }<\/span>,<\/span>
          \n "valid_until"<\/span>:<\/span> {<\/span> "type"<\/span>:<\/span> "string"<\/span>,<\/span> "format"<\/span>:<\/span> "date-time"<\/span> }<\/span>
          \n }<\/span>
          \n}<\/span><\/p>\n

          \n

          4. \u73b0\u5b9e\u95ee\u9898：\u8c01\u6765\u6784\u9020 RAR？<\/h3>\n

          RFC 9396 \u7684\u8bbe\u60f3\u662f\u5ba2\u6237\u7aef\u5728\u6388\u6743\u8bf7\u6c42\u4e2d\u5e26\u4e0a authorization_details\u3002\u4f46 Claude \u8fd9\u6837\u7684\u901a\u7528 MCP \u5ba2\u6237\u7aef\u4e0d\u8ba4\u8bc6\u94f6\u884c\u7684\u79c1\u6709 RAR \u7c7b\u578b，MCP \u89c4\u8303\u4e5f\u53ea\u5b9a\u4e49\u4e86\u57fa\u4e8e scope \u7684\u6311\u6218\u4e0e\u589e\u91cf\u6388\u6743\u3002\u64b0\u5199\u65f6，Claude \u7684 connector \u6587\u6863\u53ea\u63cf\u8ff0\u4e86 scope \u7684\u5904\u7406\u65b9\u5f0f，\u6ca1\u6709\u63d0\u53ca authorization_details\u3002<\/p>\n

          \u6240\u4ee5\u5bf9\u901a\u7528 AI \u5ba2\u6237\u7aef，\u94f6\u884c\u9700\u8981\u6362\u4e2a\u601d\u8def：\u7531\u6388\u6743\u670d\u52a1\u5668\u5728\u540c\u610f\u73af\u8282\u751f\u6210 RAR\u3002<\/p>\n\n\u65b9\u5f0f\u6d41\u7a0b\u9002\u7528<\/tr>\n\n\n\n\n
          A. AS \u4fa7\u5c55\u5f00（\u63a8\u8350）<\/td>\n\u5ba2\u6237\u7aef\u53ea\u7533\u8bf7 payments:draft；AS \u7684\u540c\u610f\u9875\u8ba9\u7528\u6237\u8bbe\u5b9a\u6263\u6b3e\u8d26\u6237\u3001\u6536\u6b3e\u4eba\u3001\u4e0a\u9650\u3001\u6709\u6548\u671f，\u751f\u6210 authorization_details \u5199\u5165 grant \u548c token<\/td>\n\u901a\u7528 AI \u5ba2\u6237\u7aef<\/td>\n<\/tr>\n
          B. \u5ba2\u6237\u7aef\u53d1\u9001 RAR<\/td>\n\u5ba2\u6237\u7aef\u901a\u8fc7 PAR \u63d0\u4ea4 authorization_details<\/td>\n\u8ba4\u8bc6\u94f6\u884c RAR \u7c7b\u578b\u7684\u5b9a\u5236\u5ba2\u6237\u7aef<\/td>\n<\/tr>\n
          C. \u5e26\u5916\u914d\u7f6e<\/td>\nMCP server \u901a\u8fc7 URL \u6a21\u5f0f elicitation \u628a\u7528\u6237\u5f15\u5230\u94f6\u884c\u9875\u9762\u914d\u7f6e\u6388\u6743，\u7ed3\u679c\u53ea\u5b58\u670d\u52a1\u7aef<\/td>\n\u9700\u8981\u5728\u4e0d\u91cd\u65b0\u6388\u6743\u7684\u60c5\u51b5\u4e0b\u8c03\u6574\u989d\u5ea6<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

          \u65b9\u5f0f A \u7684\u672c\u8d28\u662f：scope \u662f\u5ba2\u6237\u7aef\u80fd\u7406\u89e3\u7684\u300c\u7533\u8bf7\u300d，RAR \u662f\u94f6\u884c\u548c\u7528\u6237\u534f\u5546\u51fa\u7684\u300c\u6279\u51c6\u300d\u3002\u5ba2\u6237\u7aef\u4e0d\u9700\u8981\u7406\u89e3 RAR，\u53ea\u9700\u539f\u6837\u643a\u5e26 token\u3002<\/p>\n

          \n

          5. \u589e\u91cf\u6388\u6743：\u4ece\u53ea\u8bfb\u5230\u8d77\u8349<\/h3>\n

          \u624b\u673a\u94f6\u884c App<\/p>\n

          \u94f6\u884c\u6388\u6743\u670d\u52a1\u5668<\/p>\n

          \u94f6\u884c MCP server<\/p>\n

          AI \u5ba2\u6237\u7aef<\/p>\n

          \u624b\u673a\u94f6\u884c App<\/p>\n

          \u94f6\u884c\u6388\u6743\u670d\u52a1\u5668<\/p>\n

          \u94f6\u884c MCP server<\/p>\n

          AI \u5ba2\u6237\u7aef<\/p>\n

          #mermaid-svg-FYT5UyiuBdstPe2w{font-family:\\”trebuchet ms\\”,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-FYT5UyiuBdstPe2w .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-FYT5UyiuBdstPe2w .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-FYT5UyiuBdstPe2w .error-icon{fill:#552222;}#mermaid-svg-FYT5UyiuBdstPe2w .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-FYT5UyiuBdstPe2w .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-FYT5UyiuBdstPe2w .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-FYT5UyiuBdstPe2w .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-FYT5UyiuBdstPe2w .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-FYT5UyiuBdstPe2w .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-FYT5UyiuBdstPe2w .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-FYT5UyiuBdstPe2w .marker{fill:#333333;stroke:#333333;}#mermaid-svg-FYT5UyiuBdstPe2w .marker.cross{stroke:#333333;}#mermaid-svg-FYT5UyiuBdstPe2w svg{font-family:\\”trebuchet ms\\”,verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-FYT5UyiuBdstPe2w p{margin:0;}#mermaid-svg-FYT5UyiuBdstPe2w .actor{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;}#mermaid-svg-FYT5UyiuBdstPe2w text.actor>tspan{fill:black;stroke:none;}#mermaid-svg-FYT5UyiuBdstPe2w .actor-line{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);}#mermaid-svg-FYT5UyiuBdstPe2w .innerArc{stroke-width:1.5;stroke-dasharray:none;}#mermaid-svg-FYT5UyiuBdstPe2w .messageLine0{stroke-width:1.5;stroke-dasharray:none;stroke:#333;}#mermaid-svg-FYT5UyiuBdstPe2w .messageLine1{stroke-width:1.5;stroke-dasharray:2,2;stroke:#333;}#mermaid-svg-FYT5UyiuBdstPe2w #arrowhead path{fill:#333;stroke:#333;}#mermaid-svg-FYT5UyiuBdstPe2w .sequenceNumber{fill:white;}#mermaid-svg-FYT5UyiuBdstPe2w #sequencenumber{fill:#333;}#mermaid-svg-FYT5UyiuBdstPe2w #crosshead path{fill:#333;stroke:#333;}#mermaid-svg-FYT5UyiuBdstPe2w .messageText{fill:#333;stroke:none;}#mermaid-svg-FYT5UyiuBdstPe2w .labelBox{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;}#mermaid-svg-FYT5UyiuBdstPe2w .labelText,#mermaid-svg-FYT5UyiuBdstPe2w .labelText>tspan{fill:black;stroke:none;}#mermaid-svg-FYT5UyiuBdstPe2w .loopText,#mermaid-svg-FYT5UyiuBdstPe2w .loopText>tspan{fill:black;stroke:none;}#mermaid-svg-FYT5UyiuBdstPe2w .loopLine{stroke-width:2px;stroke-dasharray:2,2;stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);}#mermaid-svg-FYT5UyiuBdstPe2w .note{stroke:#aaaa33;fill:#fff5ad;}#mermaid-svg-FYT5UyiuBdstPe2w .noteText,#mermaid-svg-FYT5UyiuBdstPe2w .noteText>tspan{fill:black;stroke:none;}#mermaid-svg-FYT5UyiuBdstPe2w .activation0{fill:#f4f4f4;stroke:#666;}#mermaid-svg-FYT5UyiuBdstPe2w .activation1{fill:#f4f4f4;stroke:#666;}#mermaid-svg-FYT5UyiuBdstPe2w .activation2{fill:#f4f4f4;stroke:#666;}#mermaid-svg-FYT5UyiuBdstPe2w .actorPopupMenu{position:absolute;}#mermaid-svg-FYT5UyiuBdstPe2w .actorPopupMenuPanel{position:absolute;fill:#ECECFF;box-shadow:0px 8px 16px 0px rgba(0,0,0,0.2);filter:drop-shadow(3px 5px 2px rgb(0 0 0 \/ 0.4));}#mermaid-svg-FYT5UyiuBdstPe2w .actor-man line{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;}#mermaid-svg-FYT5UyiuBdstPe2w .actor-man circle,#mermaid-svg-FYT5UyiuBdstPe2w line{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;stroke-width:2px;}#mermaid-svg-FYT5UyiuBdstPe2w :root{–mermaid-font-family:\\”trebuchet ms\\”,verdana,arial,sans-serif;}<\/p>\n

          \u5f53\u524d token：accounts:read transactions:read<\/p>\n

          \u65b0\u7533\u8bf7 scope = \u65e7 scope \u222a payments:draft<\/p>\n

          \u7528\u6237<\/p>\n

          \u300c\u5e2e\u6211\u7ed9\u7269\u4e1a\u4ea4 1,800 \u7ba1\u7406\u8d39\u300d<\/p>\n

          1<\/p>\n

          tools\/call create_payment_draft<\/p>\n

          2<\/p>\n

          403 WWW-Authenticate: Bearer error="insufficient_scope", scope="payments:draft", resource_metadata="\u2026"<\/p>\n

          3<\/p>\n

          \u9700\u8981\u989d\u5916\u6388\u6743，\u6253\u5f00\u94f6\u884c\u9875\u9762<\/p>\n

          4<\/p>\n

          \/authorize?scope=accounts:read transactions:read payments:draft&resource=\u2026<\/p>\n

          5<\/p>\n

          \u5df2\u7ed1\u5b9a\u8bbe\u5907\u786e\u8ba4\u8eab\u4efd<\/p>\n

          6<\/p>\n

          \u751f\u7269\u8bc6\u522b<\/p>\n

          7<\/p>\n

          \u540c\u610f\u9875：\u8bbe\u5b9a\u8d77\u8349\u6388\u6743（\u8d26\u6237\u3001\u6536\u6b3e\u4eba\u3001\u4e0a\u9650\u3001\u6709\u6548\u671f）<\/p>\n

          8<\/p>\n

          \u540c\u610f<\/p>\n

          9<\/p>\n

          \u65b0 token（scope + authorization_details）<\/p>\n

          10<\/p>\n

          \u91cd\u8bd5 tools\/call create_payment_draft<\/p>\n

          11<\/p>\n

          \u6821\u9a8c RAR + \u53f0\u8d26<\/p>\n

          12<\/p>\n

          \u8349\u7a3f\u5df2\u5efa\u7acb，\u7b49\u5f85 App \u7b7e\u6838<\/p>\n

          13<\/p>\n

          \u7528\u6237<\/p>\n

          \u51e0\u4e2a\u89c4\u8303\u7ec6\u8282：<\/p>\n

            \n
          • MCP \u89c4\u5b9a\u670d\u52a1\u7aef SHOULD \u5728\u4e00\u6b21\u6311\u6218\u4e2d\u7ed9\u51fa\u5f53\u524d\u64cd\u4f5c\u9700\u8981\u7684\u5168\u90e8 scope，\u907f\u514d\u591a\u8f6e\u5f80\u8fd4；<\/li>\n
          • \u589e\u91cf\u6388\u6743\u65f6，\u5ba2\u6237\u7aef SHOULD \u628a\u4e4b\u524d\u7533\u8bf7\u7684 scope \u4e0e\u65b0\u6311\u6218\u7684 scope \u53d6\u5e76\u96c6，\u5426\u5219\u4f1a\u4e22\u5931\u539f\u6709\u6743\u9650；<\/li>\n
          • \u5ba2\u6237\u7aef SHOULD \u9650\u5236\u91cd\u8bd5\u6b21\u6570，\u907f\u514d\u6388\u6743\u5faa\u73af\u3002<\/li>\n<\/ul>\n

            \u793a\u4f8b\u4ee3\u7801\u7528 SDK \u7684 requireScopes \u58f0\u660e\u6bcf\u4e2a\u5de5\u5177\u9700\u8981\u7684 scope：<\/p>\n

            server.<\/span>registerTool<\/span>(<\/span>
            \n 'create_payment_draft'<\/span>,<\/span>
            \n {<\/span> \/* \u2026 *\/<\/span> scopeChallenge:<\/span> requireScopes<\/span>(<\/span>Scope.<\/span>PaymentsDraft)<\/span> }<\/span>,<\/span>
            \n async<\/span> (<\/span>args,<\/span> ctx)<\/span> =><\/span> {<\/span> \/* \u2026 *\/<\/span> }<\/span>,<\/span>
            \n)<\/span>;<\/span><\/p>\n

            \u672c\u5730\u6d4b\u8bd5\u4e2d，\u7528\u53ea\u8bfb token \u8c03\u7528 create_payment_draft，@modelcontextprotocol\/server 2.3.1 \u8fd4\u56de：<\/p>\n

            HTTP\/1.1 403 Forbidden
            \nwww-authenticate: Bearer error="insufficient_scope", error_description="Insufficient scope", scope="payments:draft", resource_metadata="http:\/\/127.0.0.1:8080\/.well-known\/oauth-protected-resource\/mcp"<\/p>\n

            \n

            6. \u540c\u610f\u9875：\u7528\u4eba\u8bdd\u5199\u6e05\u695a AI \u4e0d\u80fd\u505a\u4ec0\u4e48<\/h3>\n

            \u540c\u610f\u9875\u662f\u7528\u6237\u552f\u4e00\u4e00\u6b21\u770b\u6e05\u6388\u6743\u5185\u5bb9\u7684\u673a\u4f1a\u3002\u539f\u5219：<\/p>\n

          • \u5148\u8bf4 AI \u4e0d\u80fd\u505a\u4ec0\u4e48\u2014\u2014\u300c\u4e0d\u80fd\u81ea\u884c\u4ed8\u6b3e\u300d\u5e94\u51fa\u73b0\u5728\u7b2c\u4e00\u884c；<\/li>\n
          • \u6bcf\u4e2a RAR \u5b57\u6bb5\u90fd\u7ffb\u8bd1\u6210\u5177\u4f53\u6587\u5b57：\u54ea\u4e2a\u8d26\u6237\u3001\u54ea\u4e9b\u6536\u6b3e\u4eba\u3001\u6bcf\u7b14\u591a\u5c11\u3001\u5408\u5171\u591a\u5c11\u3001\u5230\u4ec0\u4e48\u65f6\u5019；<\/li>\n
          • \u7ed9\u51fa\u64a4\u9500\u8def\u5f84；<\/li>\n
          • \u94f6\u884c\u653f\u7b56\u5bf9\u7533\u8bf7\u8fdb\u884c\u6536\u7d27，\u540c\u610f\u9875\u5c55\u793a\u7684\u662f\u6536\u7d27\u540e\u7684\u7ed3\u679c\u3002<\/li>\n

            \u53c2\u8003\u5b9e\u73b0 code\/authz-server\/rar_consent.py \u5bf9\u7533\u8bf7\u505a\u653f\u7b56\u6536\u7d27（\u5355\u7b14 \u2264 HK$10,000\u3001\u7d2f\u8ba1 \u2264 HK$30,000\u3001\u6709\u6548\u671f \u2264 30 \u5929\u3001\u62d2\u7edd\u4efb\u4f55\u6267\u884c\u7c7b\u52a8\u4f5c），\u5e76\u751f\u6210\u7e41\u4f53\u4e2d\u6587\u540c\u610f\u6587\u6848：<\/p>\n

            \u5141\u8a31 AI \u52a9\u624b\u70ba\u4f60\u300c\u8d77\u8349\u300d\u8f49\u8cec，\u4f46\u4e0d\u80fd\u81ea\u884c\u4ed8\u6b3e：
            \n\u30fb\u6263\u6b3e\u8cec\u6236：\u6e2f\u5143\u5132\u84c4 ***381
            \n\u30fb\u6536\u6b3e\u4eba：\u53ea\u9650\u5df2\u767b\u8a18\u6536\u6b3e\u4eba
            \n\u30fb\u6bcf\u7b46\u4e0a\u9650 HK$10,000.00，\u5408\u5171\u4e0a\u9650 HK$30,000.00
            \n\u30fb\u6709\u6548\u81f3 2026\u5e7411\u670822\u65e5 08:00（\u9999\u6e2f\u6642\u9593）
            \n\u6bcf\u4e00\u7b46\u8f49\u8cec\u4ecd\u9700\u4f60\u5728\u793a\u4f8b\u9280\u884c App \u5167\u6838\u5c0d\u4e26\u9a57\u8b49\u5f8c\u624d\u6703\u57f7\u884c\u3002\u4f60\u53ef\u96a8\u6642\u5728 App \u7684\u300cAI \u6388\u6b0a\u7ba1\u7406\u300d\u4e2d\u53d6\u6d88\u3002<\/p>\n

            \n

            7. \u670d\u52a1\u7aef\u590d\u6838：token \u662f\u4e0a\u9650，\u53f0\u8d26\u662f\u6d88\u8017<\/h3>\n

            MCP server \u6536\u5230 create_payment_draft \u65f6，\u6309\u4ee5\u4e0b\u987a\u5e8f\u5224\u5b9a（code\/mcp-server\/src\/auth\/rar.ts）：<\/p>\n

            for<\/span> (<\/span>const<\/span> d of<\/span> details as<\/span> PaymentDraftAuthorization[<\/span>]<\/span>)<\/span> {<\/span>
            \n if<\/span> (<\/span>d?.<\/span>type !==<\/span> PAYMENT_DRAFT_TYPE<\/span>)<\/span> continue<\/span>;<\/span>
            \n if<\/span> (<\/span>!<\/span>d.<\/span>actions?.<\/span>includes<\/span>(<\/span>'create_draft'<\/span>)<\/span>)<\/span> continue<\/span>;<\/span>
            \n if<\/span> (<\/span>!<\/span>d.<\/span>locations?.<\/span>includes<\/span>(<\/span>resourceUrl)<\/span>)<\/span> continue<\/span>;<\/span>
            \n if<\/span> (<\/span>new<\/span> Date<\/span>(<\/span>d.<\/span>valid_until)<\/span> <=<\/span> now)<\/span> continue<\/span>;<\/span>
            \n if<\/span> (<\/span>d.<\/span>debtor_account_ref !==<\/span> req.<\/span>debtorAccountRef)<\/span> continue<\/span>;<\/span>
            \n if<\/span> (<\/span>d.<\/span>instructed_amount_limit.<\/span>currency !==<\/span> req.<\/span>currency)<\/span> continue<\/span>;<\/span><\/p>\n

            const<\/span> c =<\/span> d.<\/span>creditor_constraint;<\/span>
            \n const<\/span> payeeOk =<\/span>
            \n c.<\/span>mode ===<\/span> 'registered_payees_only'<\/span> ?<\/span> req.<\/span>payeeIsRegistered :<\/span> c.<\/span>payee_refs.<\/span>includes<\/span>(<\/span>req.<\/span>payeeRef)<\/span>;<\/span>
            \n if<\/span> (<\/span>!<\/span>payeeOk)<\/span> continue<\/span>;<\/span><\/p>\n

            const<\/span> amount =<\/span> toMinorUnits<\/span>(<\/span>req.<\/span>amount)<\/span>;<\/span>
            \n if<\/span> (<\/span>amount ><\/span> toMinorUnits<\/span>(<\/span>d.<\/span>instructed_amount_limit.<\/span>per_transaction)<\/span>)<\/span> continue<\/span>;<\/span>
            \n if<\/span> (<\/span>draftedSoFarMinor +<\/span> amount ><\/span> toMinorUnits<\/span>(<\/span>d.<\/span>instructed_amount_limit.<\/span>cumulative)<\/span>)<\/span> continue<\/span>;<\/span><\/p>\n

            return<\/span> {<\/span> ok:<\/span> true<\/span>,<\/span> grant:<\/span> d }<\/span>;<\/span>
            \n}<\/span><\/p>\n

            \u6ce8\u610f\u4e09\u70b9：<\/p>\n

              \n
            • \u6536\u6b3e\u4eba\u662f\u5426\u300c\u5df2\u767b\u8bb0\u300d\u4ee5\u94f6\u884c\u5b9e\u65f6\u67e5\u8be2\u4e3a\u51c6（findPayee），\u4e0d\u4fe1\u4efb\u5ba2\u6237\u7aef\u4f20\u5165；<\/li>\n
            • \u7d2f\u8ba1\u989d\u5ea6\u67e5\u670d\u52a1\u7aef\u53f0\u8d26（draftedTotalMinor），\u88ab\u62d2\u7edd\u3001\u64a4\u56de\u3001\u8fc7\u671f\u7684\u8349\u7a3f\u4e0d\u8ba1\u5165；<\/li>\n
            • \u91d1\u989d\u8f6c\u6210\u6700\u5c0f\u8d27\u5e01\u5355\u4f4d\u7684\u6574\u6570\u6bd4\u8f83，\u907f\u514d\u6d6e\u70b9\u8bef\u5dee\u3002<\/li>\n<\/ul>\n

              \u672c\u5730\u6d4b\u8bd5（RAR：\u5355\u7b14 \u2264 HK$5,000，\u7d2f\u8ba1 \u2264 HK$8,000）：<\/p>\n\n\u8bf7\u6c42\u7ed3\u679c<\/tr>\n\n\n\n\n\n
              6,000<\/td>\n\u62d2\u7edd：\u8d85\u51fa\u5355\u7b14\u4e0a\u9650<\/td>\n<\/tr>\n
              3,000<\/td>\n\u8349\u7a3f\u5efa\u7acb<\/td>\n<\/tr>\n
              6,000（\u7d2f\u8ba1 9,000）<\/td>\n\u62d2\u7edd：\u8d85\u51fa\u7d2f\u8ba1\u4e0a\u9650<\/td>\n<\/tr>\n
              1,000（\u7d2f\u8ba1 4,000）<\/td>\n\u8349\u7a3f\u5efa\u7acb<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
              \n

              8. \u7528\u6237\u4f1a\u7f29\u5c0f\u6388\u6743，\u670d\u52a1\u7aef\u8981\u63a5\u53d7<\/h3>\n

              \u7528\u6237\u53ef\u80fd\u5728\u540c\u610f\u9875\u4e0a\u53ea\u52fe\u9009\u4e00\u90e8\u5206\u8d26\u6237，\u6216\u628a\u5355\u7b14\u4e0a\u9650\u8c03\u4f4e；\u6388\u6743\u670d\u52a1\u5668\u4e5f\u53ef\u80fd\u53ea\u6388\u4e88\u7533\u8bf7 scope \u7684\u5b50\u96c6\u3002MCP \u5b89\u5168\u6700\u4f73\u5b9e\u8df5\u628a\u8fd9\u79f0\u4e3a\u300cdown-scoping tolerance\u300d：\u670d\u52a1\u7aef\u8981\u63a5\u53d7\u8303\u56f4\u6bd4\u7533\u8bf7\u66f4\u5c0f\u7684 token，\u5e76\u5728\u8d85\u51fa\u8303\u56f4\u65f6\u8fd4\u56de\u6e05\u6670\u7684\u9519\u8bef，\u5f15\u5bfc\u7528\u6237\u5230 App \u8c03\u6574，\u800c\u4e0d\u662f\u53cd\u590d\u89e6\u53d1\u589e\u91cf\u6388\u6743\u3002<\/p>\n

              \n

              9. \u66f4\u591a RAR \u7c7b\u578b：\u5916\u6c47\u4e0e\u7406\u8d22<\/h3>\n

              \u540c\u4e00\u5957\u65b9\u6cd5\u53ef\u4ee5\u6269\u5c55\u5230\u5176\u4ed6 L2 \u573a\u666f\u3002\u6bcf\u4e2a\u7c7b\u578b\u53ea\u8868\u8fbe\u8fd9\u7c7b\u4e1a\u52a1\u771f\u6b63\u9700\u8981\u7ea6\u675f\u7684\u7ef4\u5ea6\u3002<\/p>\n

              \u5916\u6c47\u8349\u7a3f：<\/p>\n

              {<\/span>
              \n "type"<\/span>:<\/span> "https:\/\/examplebank.hk\/rar\/fx-draft\/v1"<\/span>,<\/span>
              \n "actions"<\/span>:<\/span> [<\/span>"create_draft"<\/span>]<\/span>,<\/span>
              \n "locations"<\/span>:<\/span> [<\/span>"https:\/\/mcp.examplebank.hk\/mcp"<\/span>]<\/span>,<\/span>
              \n "debtor_account_ref"<\/span>:<\/span> "acc_7Hq2"<\/span>,<\/span>
              \n "creditor_account_ref"<\/span>:<\/span> "acc_Usd8"<\/span>,<\/span>
              \n "currency_pairs"<\/span>:<\/span> [<\/span>"HKD\/USD"<\/span>]<\/span>,<\/span>
              \n "sell_amount_limit"<\/span>:<\/span> {<\/span> "currency"<\/span>:<\/span> "HKD"<\/span>,<\/span> "per_transaction"<\/span>:<\/span> "20000.00"<\/span>,<\/span> "cumulative"<\/span>:<\/span> "50000.00"<\/span> }<\/span>,<\/span>
              \n "valid_until"<\/span>:<\/span> "2026-11-22T00:00:00Z"<\/span>
              \n}<\/span><\/p>\n

              \u5916\u6c47\u53ea\u5141\u8bb8\u5728\u7528\u6237\u672c\u4eba\u540d\u4e0b\u7684\u8d26\u6237\u4e4b\u95f4\u6362\u6c47，\u6240\u4ee5\u7528 creditor_account_ref \u6307\u5b9a\u5165\u8d26\u8d26\u6237，\u800c\u4e0d\u662f\u6536\u6b3e\u4eba\u7ea6\u675f\u3002\u62a5\u4ef7\u672c\u8eab\u4e0d\u8fdb RAR：\u62a5\u4ef7\u6709\u6548\u671f\u4ee5\u79d2\u8ba1，\u5c5e\u4e8e\u8349\u7a3f，\u800c\u4e0d\u662f\u6388\u6743\u3002<\/p>\n

              \u7406\u8d22\u7533\u8d2d\u8349\u7a3f：<\/p>\n

              {<\/span>
              \n "type"<\/span>:<\/span> "https:\/\/examplebank.hk\/rar\/investment-subscription-draft\/v1"<\/span>,<\/span>
              \n "actions"<\/span>:<\/span> [<\/span>"create_draft"<\/span>]<\/span>,<\/span>
              \n "locations"<\/span>:<\/span> [<\/span>"https:\/\/mcp.examplebank.hk\/mcp"<\/span>]<\/span>,<\/span>
              \n "settlement_account_ref"<\/span>:<\/span> "acc_7Hq2"<\/span>,<\/span>
              \n "product_constraint"<\/span>:<\/span> {<\/span> "max_risk_rating"<\/span>:<\/span> 3<\/span>,<\/span> "product_types"<\/span>:<\/span> [<\/span>"unit_trust"<\/span>]<\/span> }<\/span>,<\/span>
              \n "amount_limit"<\/span>:<\/span> {<\/span> "currency"<\/span>:<\/span> "HKD"<\/span>,<\/span> "per_transaction"<\/span>:<\/span> "50000.00"<\/span>,<\/span> "cumulative"<\/span>:<\/span> "100000.00"<\/span> }<\/span>,<\/span>
              \n "valid_until"<\/span>:<\/span> "2026-11-22T00:00:00Z"<\/span>
              \n}<\/span><\/p>\n

              max_risk_rating \u8ba9\u6388\u6743\u672c\u8eab\u5c31\u6392\u9664\u4e86\u8d85\u51fa\u5ba2\u6237\u98ce\u9669\u627f\u53d7\u7b49\u7ea7\u7684\u4ea7\u54c1\u3002\u5b83\u4e0d\u80fd\u66ff\u4ee3\u7b7e\u6838\u65f6\u7684\u9002\u5f53\u6027\u8bc4\u4f30（\u7b2c 9 \u7bc7），\u4f46\u80fd\u8ba9 AI \u6839\u672c\u8d77\u8349\u4e0d\u51fa\u660e\u663e\u4e0d\u5408\u9002\u7684\u7533\u8d2d\u5355\u3002<\/p>\n

              \n

              10. \u7248\u672c\u7ba1\u7406\u4e0e\u540c\u610f\u6587\u6848<\/h3>\n

              RAR \u548c scope \u8bcd\u8868\u90fd\u662f\u5bf9\u5916\u5951\u7ea6，\u4e00\u65e6\u7b7e\u53d1\u51fa\u53bb\u7684 token \u91cc\u5e26\u7740\u5b83，\u5c31\u4e0d\u80fd\u968f\u610f\u6539\u53d8\u8bed\u4e49：<\/p>\n

                \n
              • \u7c7b\u578b URI \u5e26\u7248\u672c\u53f7\u3002\u65b0\u589e\u5b57\u6bb5\u8d70 \/v2，\u65e7\u7c7b\u578b\u7ee7\u7eed\u6309\u539f\u8bed\u4e49\u6821\u9a8c，\u76f4\u5230\u6240\u6709\u5e26\u65e7\u7c7b\u578b\u7684 grant \u8fc7\u671f；<\/li>\n
              • \u540c\u610f\u6587\u6848\u4e5f\u8981\u7248\u672c\u5316\u3002\u6388\u6743\u767b\u8bb0\u518c\u4e2d\u8bb0\u5f55\u7528\u6237\u540c\u610f\u65f6\u770b\u5230\u7684\u6587\u6848\u7248\u672c（\u7b2c 8 \u7bc7\u7684 grant \u6570\u636e\u6a21\u578b），\u51fa\u73b0\u4e89\u8bae\u65f6\u53ef\u4ee5\u8fd8\u539f\u300c\u7528\u6237\u5f53\u65f6\u770b\u5230\u7684\u662f\u4ec0\u4e48\u300d；<\/li>\n
              • scope \u8bed\u4e49\u4e0d\u80fd\u6084\u6084\u53d8\u5bbd\u3002MCP \u5b89\u5168\u6700\u4f73\u5b9e\u8df5\u628a\u300c\u4e0d\u7ecf\u7248\u672c\u7ba1\u7406\u5c31\u6539\u53d8 scope \u8bed\u4e49\u300d\u5217\u4e3a\u5e38\u89c1\u9519\u8bef\u3002\u4f8b\u5982\u7ed9 cards:freeze \u589e\u52a0\u300c\u540c\u65f6\u51bb\u7ed3\u5173\u8054\u7684\u9644\u5c5e\u5361\u300d，\u5c31\u5e94\u8be5\u662f\u4e00\u4e2a\u65b0 scope，\u800c\u4e0d\u662f\u4fee\u6539\u65e7 scope \u7684\u542b\u4e49\u3002<\/li>\n<\/ul>\n
                \n

                11. \u5e38\u89c1\u9519\u8bef<\/h3>\n\n\u9519\u8bef\u540e\u679c\u6b63\u786e\u505a\u6cd5<\/tr>\n\n\n\n\n\n\n\n
                RAR \u4e2d\u51fa\u73b0 execute \u52a8\u4f5c<\/td>\nAI \u6e20\u9053\u83b7\u5f97\u4e86\u6267\u884c\u6743<\/td>\nAS \u76f4\u63a5\u62d2\u7edd，\u800c\u4e0d\u662f\u5220\u6389\u540e\u7ee7\u7eed<\/td>\n<\/tr>\n
                \u5728 RAR \u4e2d\u5199\u771f\u5b9e\u8d26\u53f7<\/td>\n\u8d26\u53f7\u51fa\u73b0\u5728 AI \u5e73\u53f0\u4fdd\u5b58\u7684 token \u91cc<\/td>\n\u53ea\u7528\u4e0d\u900f\u660e\u5f15\u7528<\/td>\n<\/tr>\n
                \u53ea\u5728 token \u4e2d\u8868\u8fbe\u7d2f\u8ba1\u989d\u5ea6<\/td>\n\u670d\u52a1\u7aef\u65e0\u6cd5\u77e5\u9053\u5df2\u7ecf\u7528\u4e86\u591a\u5c11<\/td>\n\u53f0\u8d26\u8bb0\u5f55\u6d88\u8017，token \u53ea\u8868\u8fbe\u4e0a\u9650<\/td>\n<\/tr>\n
                \u4fe1\u4efb\u5ba2\u6237\u7aef\u4f20\u5165\u7684\u300c\u6536\u6b3e\u4eba\u5df2\u767b\u8bb0\u300d<\/td>\n\u6ce8\u5165\u53ef\u4ee5\u4f2a\u9020\u8be5\u6807\u8bb0<\/td>\n\u670d\u52a1\u7aef\u5b9e\u65f6\u67e5\u8be2<\/td>\n<\/tr>\n
                scope \u4e0e RAR \u5197\u4f59\u8868\u8fbe\u540c\u4e00\u7ea6\u675f<\/td>\n\u4e24\u8005\u4e0d\u4e00\u81f4\u65f6\u4e0d\u77e5\u4ee5\u8c01\u4e3a\u51c6<\/td>\nscope \u7ba1\u300c\u80fd\u4e0d\u80fd\u8c03\u7528\u300d，RAR \u7ba1\u300c\u53c2\u6570\u8303\u56f4\u300d<\/td>\n<\/tr>\n
                \u540c\u610f\u9875\u53ea\u663e\u793a scope \u540d\u79f0<\/td>\n\u7528\u6237\u770b\u4e0d\u61c2，\u7b49\u4e8e\u6ca1\u6709\u540c\u610f<\/td>\n\u7528\u540c\u4e00\u4e2a\u6587\u6848\u751f\u6210\u5668\u751f\u6210\u540c\u610f\u9875\u4e0e\u6388\u6743\u7ba1\u7406\u4e2d\u5fc3\u7684\u63cf\u8ff0<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
                \n

                \u7ed9\u94f6\u884c\u7684\u8bbe\u8ba1\u51b3\u7b56\u6e05\u5355<\/h3>\n
              • scope \u53ea\u8868\u8fbe\u300c\u8d44\u6e90 \u00d7 \u64cd\u4f5c\u300d，\u7528\u4e1a\u52a1\u52a8\u8bcd\u547d\u540d，\u8bcd\u8868\u4e2d\u4e0d\u5b58\u5728\u4efb\u4f55\u6267\u884c\u7c7b scope \u548c\u901a\u914d\u7b26；scopes_supported \u53ea\u516c\u5e03 L0 \u57fa\u7840\u96c6\u3002<\/li>\n
              • \u8d26\u6237\u3001\u6536\u6b3e\u4eba\u3001\u91d1\u989d\u3001\u6709\u6548\u671f\u7528 RAR \u8868\u8fbe，\u4e3a\u6bcf\u4e2a RAR \u7c7b\u578b\u53d1\u5e03\u5e26\u7248\u672c\u53f7\u7684 JSON Schema，\u5e76\u5728 AS \u5143\u6570\u636e\u4e2d\u58f0\u660e authorization_details_types_supported\u3002<\/li>\n
              • \u5bf9\u901a\u7528 AI \u5ba2\u6237\u7aef\u91c7\u7528\u300cAS \u4fa7\u5c55\u5f00\u300d：\u5ba2\u6237\u7aef\u53ea\u7533\u8bf7 scope，\u7531\u540c\u610f\u9875\u4e0e\u7528\u6237\u534f\u5546\u751f\u6210 RAR；\u6388\u6743\u670d\u52a1\u5668\u6309\u94f6\u884c\u653f\u7b56\u6536\u7d27\u7533\u8bf7，\u62d2\u7edd\u4efb\u4f55\u6267\u884c\u7c7b\u52a8\u4f5c\u3002<\/li>\n
              • \u670d\u52a1\u7aef\u6bcf\u6b21\u590d\u6838 RAR，\u5e76\u7528\u53f0\u8d26\u8ba1\u7b97\u7d2f\u8ba1\u6d88\u8017；\u6536\u6b3e\u4eba\u767b\u8bb0\u72b6\u6001\u3001\u8d26\u6237\u5f52\u5c5e\u4ee5\u94f6\u884c\u5b9e\u65f6\u6570\u636e\u4e3a\u51c6\u3002<\/li>\n
              • \u53ef\u8bbf\u95ee\u8d26\u6237\u6e05\u5355\u5b58\u6388\u6743\u767b\u8bb0\u518c，\u4e0d\u5199\u5165\u5916\u90e8 token，\u7ecf Token Exchange \u4f20\u7ed9\u5185\u90e8 API，\u7528\u6237\u5728 App \u4e2d\u4fee\u6539\u540e\u5373\u65f6\u751f\u6548\u3002<\/li>\n
                \n

                \u53c2\u8003\u8d44\u6599<\/h3>\n
                  \n
                • IETF, RFC 9396 OAuth 2.0 Rich Authorization Requests.<\/li>\n
                • IETF, RFC 6749 \u00a73.3（Access Token Scope）；RFC 6750 \u00a73.1（Error Codes：insufficient_scope）.<\/li>\n
                • Model Context Protocol Specification 2026-07-28, Authorization \u2014 Scope Selection Strategy \/ Scope Challenge Handling. https:\/\/modelcontextprotocol.io\/specification\/2026-07-28\/basic\/authorization<\/li>\n
                • MCP, Security Best Practices \u2014 Scope Minimization（2026-07-28）. https:\/\/modelcontextprotocol.io\/docs\/2026-07-28\/tutorials\/security\/security_best_practices<\/li>\n
                • Anthropic, Authentication for connectors \u2014 PKCE and requested scopes. https:\/\/claude.com\/docs\/connectors\/building\/authentication<\/li>\n
                • \u793a\u4f8b\u4ee3\u7801：rar.ts\u3001scopes.ts\u3001rar_consent.py<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"

                  \u7cfb\u5217：\u300a\u8ba9 AI \u66ff\u4f60\u529e\u94f6\u884c\u4e1a\u52a1：\u9762\u5411 MCP Connector \u7684\u8eab\u4efd\u8ba4\u8bc1\u4e0e\u6388\u6743\u8bbe\u8ba1\u300b \u89c4\u8303\u57fa\u7ebf：MCP 2026-07-28（Scope Selection Strategy\u3001Scope Challenge Handling）；RFC 6749 \u00a73.3；RFC 6750 \u00a73.1；RFC 9396 \u64b0\u5199\u65e5\u671f：2026-10-23 0. \u4e00\u53e5\u8bdd\u6388<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[3179],"topic":[],"class_list":["post-121255","post","type-post","status-publish","format-standard","hentry","category-server","tag-3179"],"yoast_head":"\n\u7b2c 5 \u7bc7\uff5cAuthZ\uff08\u4e00\uff09\uff1a\u6743\u9650\u6a21\u578b\u2014\u2014\u4ece scope \u5230 Rich Authorization Requests - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.wsisp.com\/helps\/121255.html\" \/>\n<meta property=\"og:locale\" content=\"zh_CN\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"\u7b2c 5 \u7bc7\uff5cAuthZ\uff08\u4e00\uff09\uff1a\u6743\u9650\u6a21\u578b\u2014\u2014\u4ece scope \u5230 Rich Authorization Requests - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"og:description\" content=\"\u7cfb\u5217：\u300a\u8ba9 AI \u66ff\u4f60\u529e\u94f6\u884c\u4e1a\u52a1：\u9762\u5411 MCP Connector \u7684\u8eab\u4efd\u8ba4\u8bc1\u4e0e\u6388\u6743\u8bbe\u8ba1\u300b \u89c4\u8303\u57fa\u7ebf：MCP 2026-07-28（Scope Selection Strategy\u3001Scope Challenge Handling）；RFC 6749 \u00a73.3；RFC 6750 \u00a73.1；RFC 9396 \u64b0\u5199\u65e5\u671f：2026-10-23 0. \u4e00\u53e5\u8bdd\u6388\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.wsisp.com\/helps\/121255.html\" \/>\n<meta property=\"og:site_name\" content=\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"article:published_time\" content=\"2026-11-02T03:25:48+00:00\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u4f5c\u8005\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4\" \/>\n\t<meta name=\"twitter:data2\" content=\"11 \u5206\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/121255.html\",\"url\":\"https:\/\/www.wsisp.com\/helps\/121255.html\",\"name\":\"\u7b2c 5 \u7bc7\uff5cAuthZ\uff08\u4e00\uff09\uff1a\u6743\u9650\u6a21\u578b\u2014\u2014\u4ece scope \u5230 Rich Authorization Requests - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"isPartOf\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\"},\"datePublished\":\"2026-11-02T03:25:48+00:00\",\"dateModified\":\"2026-11-02T03:25:48+00:00\",\"author\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/121255.html#breadcrumb\"},\"inLanguage\":\"zh-Hans\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.wsisp.com\/helps\/121255.html\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/121255.html#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\u9996\u9875\",\"item\":\"https:\/\/www.wsisp.com\/helps\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"\u7b2c 5 \u7bc7\uff5cAuthZ\uff08\u4e00\uff09\uff1a\u6743\u9650\u6a21\u578b\u2014\u2014\u4ece scope \u5230 Rich Authorization Requests\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\",\"url\":\"https:\/\/www.wsisp.com\/helps\/\",\"name\":\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"description\":\"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"zh-Hans\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"contentUrl\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"caption\":\"admin\"},\"sameAs\":[\"http:\/\/wp.wsisp.com\"],\"url\":\"https:\/\/www.wsisp.com\/helps\/author\/admin\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"\u7b2c 5 \u7bc7\uff5cAuthZ\uff08\u4e00\uff09\uff1a\u6743\u9650\u6a21\u578b\u2014\u2014\u4ece scope \u5230 Rich Authorization Requests - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.wsisp.com\/helps\/121255.html","og_locale":"zh_CN","og_type":"article","og_title":"\u7b2c 5 \u7bc7\uff5cAuthZ\uff08\u4e00\uff09\uff1a\u6743\u9650\u6a21\u578b\u2014\u2014\u4ece scope \u5230 Rich Authorization Requests - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","og_description":"\u7cfb\u5217：\u300a\u8ba9 AI \u66ff\u4f60\u529e\u94f6\u884c\u4e1a\u52a1：\u9762\u5411 MCP Connector \u7684\u8eab\u4efd\u8ba4\u8bc1\u4e0e\u6388\u6743\u8bbe\u8ba1\u300b \u89c4\u8303\u57fa\u7ebf：MCP 2026-07-28（Scope Selection Strategy\u3001Scope Challenge Handling）；RFC 6749 \u00a73.3；RFC 6750 \u00a73.1；RFC 9396 \u64b0\u5199\u65e5\u671f：2026-10-23 0. \u4e00\u53e5\u8bdd\u6388","og_url":"https:\/\/www.wsisp.com\/helps\/121255.html","og_site_name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","article_published_time":"2026-11-02T03:25:48+00:00","author":"admin","twitter_card":"summary_large_image","twitter_misc":{"\u4f5c\u8005":"admin","\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4":"11 \u5206"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.wsisp.com\/helps\/121255.html","url":"https:\/\/www.wsisp.com\/helps\/121255.html","name":"\u7b2c 5 \u7bc7\uff5cAuthZ\uff08\u4e00\uff09\uff1a\u6743\u9650\u6a21\u578b\u2014\u2014\u4ece scope \u5230 Rich Authorization Requests - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","isPartOf":{"@id":"https:\/\/www.wsisp.com\/helps\/#website"},"datePublished":"2026-11-02T03:25:48+00:00","dateModified":"2026-11-02T03:25:48+00:00","author":{"@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41"},"breadcrumb":{"@id":"https:\/\/www.wsisp.com\/helps\/121255.html#breadcrumb"},"inLanguage":"zh-Hans","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.wsisp.com\/helps\/121255.html"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.wsisp.com\/helps\/121255.html#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u9996\u9875","item":"https:\/\/www.wsisp.com\/helps"},{"@type":"ListItem","position":2,"name":"\u7b2c 5 \u7bc7\uff5cAuthZ\uff08\u4e00\uff09\uff1a\u6743\u9650\u6a21\u578b\u2014\u2014\u4ece scope \u5230 Rich Authorization Requests"}]},{"@type":"WebSite","@id":"https:\/\/www.wsisp.com\/helps\/#website","url":"https:\/\/www.wsisp.com\/helps\/","name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","description":"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"zh-Hans"},{"@type":"Person","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41","name":"admin","image":{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/","url":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","contentUrl":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","caption":"admin"},"sameAs":["http:\/\/wp.wsisp.com"],"url":"https:\/\/www.wsisp.com\/helps\/author\/admin"}]}},"_links":{"self":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/121255","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/comments?post=121255"}],"version-history":[{"count":0,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/121255\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/media?parent=121255"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/categories?post=121255"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/tags?post=121255"},{"taxonomy":"topic","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/topic?post=121255"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}