It isn't 'being part of a group' that matters (which is only a valid description for an agent in the context of a particular statement, not the general authorization case), but being part of a 3-legged OAuth flow, which means we put the Agent in a Group and make that the authority; see my proposed replacement text below.