Enabling a minimum ICM version for forward compatibility across APIs versions

[tanjadegroot]

Problem description
ICM versions may change without impacting APIs. However, alignment with CAMARA meta-releases requires alignment with latest ICM versions. API providers do not necessarily update their security mechanisms (ICM version) when upgrading their APIs or when adding newer APIs release with newer ICM versions.

Possible evolution
Discuss how CAMARA can support an easier way of handling ICM releases across APIs, covering both backward and forward compatibility.

Additional context
This issue has been raise by BridgeAlliance in the GSMA OGWTG as a major issue for aggregators.

[jpengar]

As mentioned in camaraproject/IdentityAndConsentManagement#340, CAMARA has not yet defined how to handle changes to ICM definitions and guidelines that are not backwards compatible. This is something that we may need to address in this issue as well since it is quite related.

It may be necessary to establish timeframes for supporting each ICM release and for upgrading to a new ICM version after its release. For example, the fact that the current versions of ICM aren't stable could mitigate the impact. However, if we transition to a stable version, the situation changes.

Then, for instance, it may also be necessary to clarify whether exceptions can be applied to these rules for addressing security vulnerabilities as soon as possible when needed.