better (minus the 'and' after MUST)... I used client and resource owner to match the terms in the OAuth spec.

I was also thinking the req up here could say "A Group MUST only be used when representing OAuth credentials, see OAuth Credentials below for more..", ugh I'm not liking that either, but it lets developers know group is only for oauth and there's more requirements below?