docs: include consent-time access_denied for inactive accounts

Clarify that provider-side active-account enforcement can reject OAuth consent submission when account status changes during the authorization session.
2026-02-26 12:26:45 +00:00
parent df7ca1329e
commit d97638201e
1 changed files with 1 additions and 0 deletions
@@ -139,6 +139,7 @@ try {
 Provider login/authorization steps can also fail with `access_denied` when account status is disabled before completion.
 WebAuthn-based login verification can return credential-style failures for disabled accounts even when authenticator assertions are otherwise valid.
 Existing authenticated sessions may also be invalidated when account status changes to disabled.
+OAuth authorization consent submission can return `access_denied` if the account becomes inactive between session establishment and consent completion.

 ## Operational guidance