Decide where the work belongs
Map the blocked flow
For each variant, record environment, user journey stage, callback result, account state, and whether a code or token exchange was attempted. Separate pre-callback denial from post-callback session loss. Keep codes and tokens out of the queue evidence.
Compare safe recovery
Assess correcting one registration, restarting an expired session, returning a clear error, or requesting owner review. Record required authority and rollback. Do not accept a callback with missing state or broaden a redirect pattern to cover an unknown host.
Set callback order
Queue missing state and wrong-host exposure first, then shared registration errors and isolated stale sessions. Set owner, fixture, review time, and evidence threshold. If environment ownership is unclear, prioritize exact registration evidence before copy changes.
What to carry forward
Return a callback queue with URI and state evidence, account consequence, safe containment, owner, and acceptance proof. Escalate any response not bound to its initiating session. Keep rank provisional where registration or exchange evidence is external.
Technical background: RFC Editor reference.
Keep the decision with the work.
Use a Work Item in Aglet to record the problem, the evidence you have, and the next decision. Add an owner and priority, then keep updates in the discussion so the next person can follow the reasoning.
Create an account See the product workflow