This isn't commonly done, but given some of the considerations forthcoming as part of #244 and #247 I'm wondering if it makes sense to normatively define parts of the permission experience that MUST be present before permission to share information can be considered granted, e.g.

• The origin of the verifier that requests the credential
• The information that is being requested
• Which wallet(s) can be used to fulfill the credential request
• Which credential would be used to share the requested information

If in practice user agents do this anyway it seems beneficial to make normative, although again it would be a little unconventional to venture so far into user agent UX on a spec level.

Any thoughts?