There's still a difference between the old (Authority MUST NOT be a Group, unless used in the OAuth workflow) and the new (A Group authority MUST contain two Agents which represent an application and user)

I think the only thing that bothers me is the group MUST isn't explicitly stated to only be allowed for representing 3-legged OAuth credentials

What about "If the authority is a Group, it MUST contain only two Agents representing the Resource Owner and Client of 3-legged OAuth".. meh, something to say Group is only ok when the Authentication method was 3-legged OAuth