give client metadata values conveyed in a software statement precedence over values conveyed using plain JSON elements.

Condition: if the authorization server supports software statements

If the server supports software statements, client metadata values conveyed in the software statement MUST take precedence over those conveyed using plain JSON elements.

treat `software_id` and other client metadata as self-asserted.

Condition: unless the metadata is used as a claim in a software statement

Unless used as a claim in a software statement, the authorization server MUST treat all client metadata as self-asserted.

take appropriate steps to mitigate impersonation or false-association risks by considering the entire registration request and client configuration.

Condition: when processing self-asserted client metadata such as `software_id`

an authorization server MUST take appropriate steps to mitigate this risk by looking at the entire registration request and client configuration.

consider the full registration request, including the software statement, initial access token, and JSON client metadata values.

Condition: when deciding whether to honor a registration request

An authorization server MUST consider the full registration request, including the software statement, initial access token, and JSON client metadata values, when deciding whether to honor a given registration request.

treat a suspected duplicate registration as suspect and reject it.

Condition: if the client is not intended to have multiple simultaneous registrations and duplication can be inferred, such as from matching `software_id` and `software_version` values

the server SHOULD treat the new registration as being suspect and reject the registration.

keep `software_id` the same for all instances of the client software.

the "software_id" SHOULD remain the same for all instances of the client software.

keep `software_id` the same across multiple updates or versions of the same software.

The "software_id" SHOULD remain the same across multiple updates or versions of the same piece of software.

include the `software_id` claim in a software statement.

Condition: to allow authorization servers to correlate different instances of software using the same software statement

It is RECOMMENDED that software statements contain the "software_id" claim to allow authorization servers to correlate different instances of software using the same software statement.