Hello,

I'd like to know what is the good practice to authorize access to a resource (and/or scope) based on a constraint imposed to the user requesting the resource.
For example, the user could have to enter a password, otp or to pay before accessing the resource.

How should I design it in terms of policies, permissions etc. ? And also how to redirect the user to the flow that will allow him to validate the not fulfilled constraints yet before asking again permissions ?

Thanks