do we really need to state this again?

do we really need to state this again?

Does that include unknown data fields in an `openid_credential` within the `authorization_details` structure? RFC 9396, Section 7.1 states that the AS may enrich `authorization_details` in the Token Response. Since we added extensibility for the `openid_credential` type, I think we should be clear on how the Wallet must treat a response with unknown data fields. We can add a normative statement here or under #(authorization-details. @pmhsfelix had the same concern [in another comment](https://github.com/openid/OpenID4VCI/pull/382#discussion_r1757151581) and suggested that the Wallet MUST ignore any unrecognized data fields.

I wonder if this extensibility is actually compliant with RAR. Section 5 of RFC 9396 states that: > The AS MUST abort processing and respond with an error `invalid_authorization_details` to the client if [an object in the authorization_details structure] [...] is an object of known type but containing unknown fields, Does the proposed extensibility mean that, when it comes to the `openid_credential` type, there are no "unknown fields" because by definition, any unrecognized field gets ignored and consequently all fields are expected and thus "known"?

Since the `authorization_details` in the authorization request is created by the wallet itself, does it make sense to state that "The Wallet MUST ignore any unrecognized parameters"? Perhaps this sentence should be in the `token-response` section, where the `authorization_details` is generated by the AS.