How about - "Authority must be an Agent, except in 3-legged OAuth, where it can be a Group with two Agents."