yeah.. "Authority MUST be an Agent, except in 3-legged OAuth, where it MUST a Group with two Agents."

i think they're meant to be MUST requirements