Include token protection services in G081?

[marcvs]

This issue was created with the document version "v1"

Services (such as vault or mytoken, we will not name them in the document) proxy a refresh token for the users and give them a proprietary token. This may help in some cases or not in other cases.

How do people feel about including such services in the doc. Do we want to add also lifetime recommendations on such services? It may derail the doc a bit, so in the current version I've only kept a very short remark.

[msalle]

It's a bit tricky because there isn't really an RFC or other standard for them, but it does follow a certain pattern that requires careful risk assessment and guidance. I'm probably in favour of adding them in a special category.