Guidance around data authorization model and secure authenticated access to an OData Service

Publishers of services requiring authentication SHOULD consider supporting basic authentication over HTTPS and MAY support other authentication methods (highlight this fact in intermediate conformance level). Interoperable clients SHOULD be prepared to handle basic authentication. Services SHOULD NOT change their data model depending on the authenticated user. If the data model is user (group) dependent, all changes MUST be safe changes as defined in 5.2 Endpoint Versioning when comparing the actual model to the model visible to users with minimal authorizations. Accepted: https://www.oasis-open.org/committees/download.php/49125/odata-meeting-36_on-20130509-minutes.html#odata-301 Discussed and accepted: https://www.oasis-open.org/apps/org/workgroup/odata/download.php/49132/odata-meeting-36_on-20130509-minutes.html