@@ -0,0 +1,21 @@
+---
+'@objectstack/runtime': patch
+'@objectstack/plugin-auth': patch
+'@objectstack/platform-objects': patch
+---
+
+fix(runtime,plugin-auth)!: a banned user's OAuth access tokens and refresh grants are refused while the ban holds
+
+Clause-②: yes (narrowing) — while a user's ban holds, an OAuth access token that user consented to is answered at the MCP door as a token that does not verify (the generic `401`, with the same body and `WWW-Authenticate` header), and so is an agent forward credential acting for that user; `/oauth2/userinfo` answers that token as an access token that does not verify (`401 invalid_token`), and `/oauth2/introspect` answers that user's access and refresh tokens as inactive (`{ "active": false }`); the token endpoint mints that user no token: a `refresh_token` grant answers as an invalid refresh token (`400 invalid_grant`), and an `authorization_code` exchange is refused, with the code spent: by the provider's own session answer (`400 invalid_request`) when the ban ended the user's sessions, as the ban routes do, and otherwise as an invalid code (`400 invalid_grant`). Those are the doors this change narrows.
+Metadata-protocol: none
+
+<!-- adr-0087: not-required (no-migration-prescription) No key of any schema is added, removed, renamed or re-shaped and nothing at rest changes: the ban columns are read where an OAuth credential becomes its user or is read back, and no token, grant or consent row is revoked or rewritten. -->
+
+**BREAKING** accept-set narrowing at the MCP door and at the OAuth authorization server's token, userinfo and introspection endpoints: a banned user's OAuth access tokens and refresh grants are refused while the ban holds.
+
+- **The rule.** Banning a user already ends their sessions and refuses their sign-in and their API keys. While the ban holds, their OAuth access tokens are now also refused at the MCP door and read as not valid at userinfo and introspection, and the token endpoint mints them no new token (no refresh, no code exchange). A ban with an expiry stops binding once the expiry has passed, exactly as sign-in does.
+- **Not a revocation.** No token, refresh token or consent row is revoked or rewritten. Lifting the ban (or letting it expire) admits the same access token at the MCP door and lets the same refresh token renew, with nothing reissued. An authorization code presented while the ban held is spent, so the client signs the user in again.
+- **Cost.** One primary-key read of the user's ban columns per OAuth credential the MCP door resolves, and one read of the user row per active introspection answer that names a user; the token and userinfo endpoints read nothing extra. A store fault on the MCP door's read answers `503 SERVICE_UNAVAILABLE`, as every other authorization-input read on that door does; a store fault on the introspection read fails the request rather than answering active or inactive.
+- **Who moves.** An MCP client or OIDC relying party connected over OAuth on behalf of a banned user gets `401` at the MCP door and at userinfo, `{ "active": false }` from introspection, and `400` from the token endpoint, until the ban is lifted or expires. The Ban User confirmation (`@objectstack/platform-objects`) and the administrator and authentication guides now say so.
+
+**The remedy.** Lift the ban, or connect the client as a user who is not banned.
@@ -82,7 +82,7 @@ only on reorgs. Why the tree matters:
 
 Day-to-day lifecycle actions live on each user's row menu and record header:
 **Ban / Unban** (blocks sign-in, ends the user's sessions, and refuses their API keys
-while the ban holds), **Unlock Account** (clears a brute-force
+and OAuth access tokens while the ban holds, with no new OAuth token issued to them), **Unlock Account** (clears a brute-force
 lockout early, at both the password and two-factor stages), **Set Password**
 (also mints one-time temporary passwords),
 and **Impersonate User** (see [Step 4](#step-4--verify)). *(Rough edge today:
@@ -201,7 +201,7 @@ Full model: [Permission Sets](/docs/permissions/permission-sets).
 | I need to… | Do this |
 |:--|:--|
 | Onboard a new employee | Invite/Create the user → Business Unit Member row → assign their position ([2](#step-2--add-people-users)→[3](#step-3--assign-positions)) |
-| Offboard someone | **Ban User** (blocks sign-in and the user's API keys immediately) — then hand over their records ([below](#handing-over-a-banned-users-work)) and remove assignments at leisure |
+| Offboard someone | **Ban User** (blocks sign-in, the user's API keys and their OAuth access tokens and token refreshes immediately) — then hand over their records ([below](#handing-over-a-banned-users-work)) and remove assignments at leisure |
 | "I can't sign in" | User record → is it banned? locked? **Unlock Account** or **Set Password** (temporary, must-change) |
 | "Why can't I see X?" | Studio → Access → **Explain access** for that user + object |
 | Someone changed departments | Update their Business Unit Member row; re-anchor their User Position rows |
 
@@ -1261,7 +1261,7 @@ All endpoints are available under `/api/v1/auth/*`:
 - `POST /api/v1/auth/admin/set-user-password` - Set/reset a user's password (also provisions a credential for SSO-onboarded users)
 - `POST /api/v1/auth/admin/import-users` - Bulk import users (CSV/JSON/XLSX; `auto` (default, per-row invite-or-temporary) / `invite` / `temporary` / `none` password policy; ≤500 rows, dry-run supported)
 - `POST /api/v1/auth/admin/unlock-user` - Clear a brute-force lockout early
-- `POST /api/v1/auth/admin/ban-user` - Ban a user (blocks sign-in and revokes live sessions; the user's API keys are refused at every door while the ban holds, and a ban with an expiry stops binding once it expires. The keys are not revoked)
+- `POST /api/v1/auth/admin/ban-user` - Ban a user (blocks sign-in and revokes live sessions; the user's API keys are refused at every door while the ban holds; their OAuth access tokens are refused at the MCP endpoint and read as not valid at `/oauth2/userinfo` and `/oauth2/introspect`, and the token endpoint issues them no new token; a ban with an expiry stops binding once it expires. Neither the keys nor the OAuth tokens are revoked)
 - `POST /api/v1/auth/admin/unban-user` - Lift a ban, restoring the account's ability to sign in and its API keys (each key is still judged by its own lifecycle: a key left unused past the inactivity window during the ban answers as inactive, and needs replacing)
 
 #### Organization Membership (requires `plugins.organization`; platform-admin gated)
 
@@ -159,7 +159,7 @@ export const enObjects: NonNullable<TranslationData['objects']> = {
       },
       ban_user: {
         label: "Ban User",
-        description: "Ban this user? They will be signed out, unable to sign in, and their API keys refused until unbanned. The keys work again after the unban.",
+        description: "Ban this user? They will be signed out, unable to sign in, and their API keys refused until unbanned, as are their OAuth access tokens and token refreshes. The keys work again after the unban.",
         successMessage: "User banned",
         params: {
           banReason: {
 
@@ -159,7 +159,7 @@ export const esESObjects: NonNullable<TranslationData['objects']> = {
       },
       ban_user: {
         label: "Bloquear usuario",
-        description: "¿Bloquear a este usuario? Cerrará sesión, no podrá volver a iniciarla y sus claves de API se rechazarán hasta que se desbloquee. Las claves vuelven a funcionar tras el desbloqueo.",
+        description: "¿Bloquear a este usuario? Cerrará sesión, no podrá volver a iniciarla y sus claves de API se rechazarán hasta que se desbloquee, al igual que sus tokens de acceso OAuth y sus renovaciones de token. Las claves vuelven a funcionar tras el desbloqueo.",
         successMessage: "Usuario bloqueado",
         params: {
           banReason: {
 
@@ -159,7 +159,7 @@ export const jaJPObjects: NonNullable<TranslationData['objects']> = {
       },
       ban_user: {
         label: "利用停止",
-        description: "このユーザーを利用停止にしますか？利用停止になるとサインアウトされ、解除されるまでサインインできず、API キーも拒否されます。解除後はキーが再び使えるようになります。",
+        description: "このユーザーを利用停止にしますか？利用停止になるとサインアウトされ、解除されるまでサインインできず、API キーも拒否されます。OAuth アクセストークンとトークンの更新も同様に拒否されます。解除後はキーが再び使えるようになります。",
         successMessage: "ユーザーを利用停止にしました",
         params: {
           banReason: {
 
@@ -159,7 +159,7 @@ export const zhCNObjects: NonNullable<TranslationData['objects']> = {
       },
       ban_user: {
         label: "封禁用户",
-        description: "要封禁该用户吗？封禁后会立即登出，在解除封禁前无法再次登录，其 API 密钥也会被拒绝。解除封禁后这些密钥恢复可用。",
+        description: "要封禁该用户吗？封禁后会立即登出，在解除封禁前无法再次登录，其 API 密钥也会被拒绝，OAuth 访问令牌与令牌续期同样被拒绝。解除封禁后这些密钥恢复可用。",
         successMessage: "用户已封禁",
         params: {
           banReason: {
 
@@ -147,11 +147,12 @@ describe('#7309 — the destructive warnings survived the move, word for word',
   it('sys_user.ban_user still says the user is signed out and locked out', () => {
     const a = byName(SysUser, 'ban_user');
     expect(a.description).toBe(
-      'Ban this user? They will be signed out, unable to sign in, and their API keys refused until unbanned. The keys work again after the unban.',
+      'Ban this user? They will be signed out, unable to sign in, and their API keys refused until unbanned, as are their OAuth access tokens and token refreshes. The keys work again after the unban.',
     );
     expect(a.description).toContain('signed out');
     expect(a.description).toContain('unable to sign in');
     expect(a.description).toContain('API keys refused');
+    expect(a.description).toContain('OAuth access tokens and token refreshes');
   });
 
   it('sys_user.delete_my_account still says it cannot be undone', () => {
 
@@ -207,7 +207,7 @@ export const SysUser = ObjectSchema.create({
       // and nothing is POSTed until that one dialog's own Confirm.
       // NB: the top-level `description` (#7367), never `ai.description` — that
       // one is the LLM-facing tool contract and is shown to no user.
-      description: 'Ban this user? They will be signed out, unable to sign in, and their API keys refused until unbanned. The keys work again after the unban.',
+      description: 'Ban this user? They will be signed out, unable to sign in, and their API keys refused until unbanned, as are their OAuth access tokens and token refreshes. The keys work again after the unban.',
       params: [
         { name: 'banReason', label: 'Ban Reason', type: 'text', required: false },
       ],
@@ -216,7 +216,7 @@ export const SysUser = ObjectSchema.create({
       ai: {
         exposed: true,
         description:
-          'Ban a user (the record; optionally banReason): they are signed out, cannot sign in, and their API keys are refused until unbanned; the keys work again after the unban. Platform administrators only. Ask the human to confirm before calling.',
+          'Ban a user (the record; optionally banReason): they are signed out, cannot sign in, and their API keys, OAuth access tokens and token refreshes are refused until unbanned; the keys work again after the unban. Platform administrators only. Ask the human to confirm before calling.',
         requiresConfirmation: true,
       },
     },
 
@@ -18,7 +18,13 @@
  *  2. a body destructured, in the same function, from the result of
  *     `judgeHeldSession(...)`: the held-session judge's ADR-0112 envelope,
  *     whose code sits under `error` (`platform-admin-gate.held-session.test.ts`
- *     pins that body's shape).
+ *     pins that body's shape); or
+ *  3. an OAuth 2.0 error response (RFC 6749 §5.2): an object literal with a
+ *     top-level `error` whose value is a string literal, beside an
+ *     `error_description`. That is the dialect the authorization server's own
+ *     endpoints answer in, and `error` is its machine code; a refusal that must
+ *     answer exactly as the provider's own error does (`oauth-grant-ban-refusal.ts`)
+ *     carries no second, ADR-0112 `code` the provider's answer lacks.
  *
  * No body, a literal without `code`, a spread, or an identifier from anywhere
  * else is a site this pin cannot read a code from, so it fails.
@@ -128,7 +134,15 @@ function whyCodeless(site: ts.NewExpression, sf: ts.SourceFile): string | null {
     const carriesCode = body.properties.some(
       (p) => (ts.isPropertyAssignment(p) || ts.isShorthandPropertyAssignment(p)) && propertyName(p.name) === 'code',
     );
-    return carriesCode ? null : 'its body has no top-level `code` property';
+    if (carriesCode) return null;
+    // Shape 3: the OAuth 2.0 error response — a literal `error` code beside an `error_description`.
+    const oauthError = body.properties.some(
+      (p) => ts.isPropertyAssignment(p) && propertyName(p.name) === 'error' && ts.isStringLiteralLike(p.initializer),
+    );
+    const oauthDescription = body.properties.some(
+      (p) => (ts.isPropertyAssignment(p) || ts.isShorthandPropertyAssignment(p)) && propertyName(p.name) === 'error_description',
+    );
+    return oauthError && oauthDescription ? null : 'its body has no top-level `code` property';
   }
   if (ts.isIdentifier(body) && isHeldSessionBody(body, site)) return null;
   return `its body is \`${body.getText(sf)}\`, which this pin cannot read a code from`;
@@ -244,6 +258,16 @@ describe('the classifier, against the shapes it must tell apart', () => {
     expect(verdicts(fixture)).toEqual([true, true, true, true, true]);
   });
 
+  it('accepts an OAuth 2.0 error response (a literal `error` beside an `error_description`), and nothing short of it', () => {
+    const fixture = `
+      function a(d: string) { throw new APIError('BAD_REQUEST', { error_description: d, error: 'invalid_grant' }); }
+      function b() { throw new APIError('BAD_REQUEST', { error_description: 'invalid code', error: 'invalid_grant' }); }
+      function c() { throw new APIError('BAD_REQUEST', { error: 'invalid_grant' }); }
+      function d(e: string) { throw new APIError('BAD_REQUEST', { error_description: 'x', error: e }); }
+      function f() { throw new APIError('BAD_REQUEST', { error_description: 'x' }); }`;
+    expect(verdicts(fixture)).toEqual([true, true, false, false, false]);
+  });
+
   it('the textual control sees past comments, and counts a member-callee site', () => {
     const fixture = `
       // new APIError('FORBIDDEN', { message: 'in a comment' })