Partway through a workflow, a client holding a token with files:read calls a tool and gets HTTP 403 with error="insufficient_scope" and scope="files:write". How should the client respond?
Select an answer to reveal the explanation.
Short Explanation
Step-up authorization means adding to your keyring, not swapping it out. You ask for what you had plus what's newly needed, so reads keep working. And you cap your retries so you're not stuck in an endless consent loop.
Full Explanation
When a request fails with insufficient scope at runtime, servers should answer HTTP 403 with a WWW-Authenticate Bearer challenge carrying error="insufficient_scope", the scopes needed for the operation, and resource_metadata. Clients acting for a user should attempt step-up authorization: parse the error, compute the required scopes as the union of the previously requested scope set and the challenged scopes, re-authorize with that set, and retry the original request, treating repeated failure as permanent. Clients should implement retry limits and track scope upgrade attempts to avoid loops for the same resource and operation. Here that means requesting files:read and files:write together. Requesting files:write alone fails because the new token would lose files:read, and the next read would trigger another challenge; servers are not required to repeat previously granted scopes, which is exactly why the union is the client's job. Retrying with the same token fails by concept: insufficient_scope is a deterministic authorization result, not a transient fault, so an unchanged token will fail again. Treating the 403 as an invalid token fails because invalid or expired tokens receive 401, while 403 here means the token is valid but under-scoped; re-registration solves nothing. Exam caveat: client_credentials clients may abort instead of stepping up. Operational check: confirm the re-authorization request lists both scopes.