I've done a little bit of digging into OAuth, and I was thinking about how it could compare and work with the W3C's Access Control spec.
AC specifies a static mechanism so that one domain can grant another domain access to specific domain and URI identified resources in the browser. In contrast, OAuth specifies a mechanism so that a user can grant one domain to access protected resources.
These are very different specs but perhaps they ought to be aligned? I have a few ideas about that, and I'm sure there are a lot of others.
Any reason why the W3C might not just move to adopt what we've done with OAuth? I mean, what other use cases does their spec afford that OAuth does not? And, why reinvent the wheel when OAuth is based on what the leading technology vendors were already doing?