Require specific first resource

[clehner]

Require a specific value as the first resource URI to invoke CACAO-ZCAP, i.e. to authorize transforming the CACAO to a ZCAP.
The value used is a URI in this specification's namespace for a term "CacaoZcapResource2022" (not included in the JSON-LD context since it does not appear in the resulting ZCAP, only in the CACAO.

[chunningham]

Can we instead infer this from the last entry being a urn:zcap:root:...?

[clehner]

Can we instead infer this from the last entry being a urn:zcap:root:...?

I don't think so... urn:zcap:root is only appearing in the zCap (parentCapability and capabilityChain); in the CACAO it's just a URI. https://demo.didkit.dev/2022/cacao-zcap/#root-zcap-mapping

[clehner]

Consensus so far seems to be to not merge this, and allow basically any CACAO to be a zCap via this specification.
Applications needing assurance that a CACAO-ZCAP was intended by its signer to be a CACAO-ZCAP will need to obtain this in an application-specific way, e.g. by checking the invocation target URI (first resource) and/or the statement string.
Edit: maybe the spec should note this as a security consideration.