Rebase & Amend wording

Author: ThisIsMissEm

draft-ietf-oauth-client-id-metadata-document.md

@@ -34,6 +34,7 @@ normative:
   RFC6749:
   RFC6819:
   RFC7591:
+  RFC8259:
   RFC8414:
   RFC9700:
 
@@ -151,9 +152,20 @@ the client to the user in an authorization consent screen, for example the
 client name and logo.
 
 The authorization server SHOULD fetch the document indicated by the `client_id`
-to retrieve the client registration information. A successful response MUST use the 200 OK HTTP status code and return a JSON object using the `application/json` or `application/<AS-defined>+json` content type. The authorization server MUST treat all other HTTP status codes and content types as an error response. The authorization server MUST NOT automatically follow redirects given via the Location header in responses.
+to retrieve the client registration information. A successful response MUST use
+the 200 OK HTTP status code, have the content type of `application/json` or a more
+specific content type that conforms to `application/<AS-defined>+json`, and be a
+valid JSON object {{RFC8259}}. The authorization server MUST treat all other
+HTTP status codes and content types as an error response. The authorization
+server MUST NOT automatically follow HTTP redirects when retrieving the client
+registration information.
 
-## Client Metadata
+If authorization server encounters an error response when retrieving the client
+registration information, the authorization server SHOULD abort the
+authorization request. The authorization server MAY use error responses to
+inform their security policies.
+
+## Client Metadata Documents
 
 The client metadata document URL is a JSON document containing the metadata
 of the client. The client metadata values are the values defined in
@@ -166,7 +178,8 @@ defined in [RFC3986] Section 6.2.1.
 
 The client metadata document MAY define additional properties in the response.
 The client metadata document MAY also be served with more specific content types
-as long as the response is JSON and conforms to `application/<AS-defined>+json`.
+as long as the response is a valid JSON object and the content type conforms to
+`application/<AS-defined>+json`.
 
 As there is no way to establish a shared secret to be used with client metadata
 documents, the following restrictions apply on the contents of the
@@ -194,16 +207,11 @@ When developing applications against an authorization server which uses this spe
 
 To enable developers to author applications on their machines, without exposing their machines to the public internet, the usage of Client ID Metadata Document Services by the authorization server is RECOMMENDED.
 
-A Client ID Metadata Document Service is a web service through which developers can acquire a stable URL to a Client ID Metadata Document. This service MAY expire clients from time to time, and MAY require developers to provide additional information about the client being developed.
+A Client ID Metadata Document Service is a web service through which developers can acquire a stable URL to a Client ID Metadata Document. This service MAY expire clients from time to time, and MAY require developers to provide additional information about the client being developed. The only requirement on Client ID Metadata Document Services is that they MUST return valid Client ID Metadata Documents for the `client_id` that they provision, or return a status code indicating an error response (e.g., 404 Not Found). How a Client ID Metadata Document Service creates or stores metadata documents is outside of the scope of this document.
 
 
 By providing at least one Client ID Metadata Document Service, an authorization server can enable developers to create applications, and still indicate to non-technical people that the client that they are about to authorize is currently under-development and may not be trustworthy or secure.
 
-## Metadata Discovery Errors
-
-If fetching the metadata document fails, the authorization server SHOULD abort the
-authorization request.
-
 ## Metadata Caching
 
 The authorization server MAY cache the client metadata it discovers at the