It also looks unnecessary? Like, RSA7b lays out when the clientId should not be null, why do we need another spec item that lays when when it should be null? If RSA12 is the exact reverse of RSA7b it's unnecessary; if not it's contradictory
(It'd also be nice if the subitems of RSA7b were explicit about their relationship to each other. Eg "If a clientId is provided in the clientOptions, or else if ...". Like... you can guess from context that they're OR'd together not ANDed, but you shouldn't need to guess from context, and it's unclear which takes priority if more than one apply.)
From me (internal Slack message):
@SimonWoolf responded with:
┆Issue is synchronized with this Jira Task by Unito