diff --git a/doc/Security.xml b/doc/Security.xml
index cfd8c6535..3d3231845 100644
--- a/doc/Security.xml
+++ b/doc/Security.xml
@@ -297,6 +297,10 @@
       >http://www.ietf.org/rfc/rfc6750.txt</link>&gt;</para>
     <para>RFC 7292 - PKCS #12: Personal Information Exchange Syntax v1.1</para>
     <para>&lt;<link xmlns:xlink="http://www.w3.org/1999/xlink" xlink:href="https://datatracker.ietf.org/doc/html/rfc7292"/>&gt;</para>
+    <para>IETF RFC 7515 JSON Web Signature (JWS)</para>
+    <para>&lt;<link xmlns:xlink="http://www.w3.org/1999/xlink"
+        xlink:href="http://www.ietf.org/rfc/rfc7515.txt"
+      >http://www.ietf.org/rfc/rfc7515.txt</link>&gt;</para>
     <para>IETF RFC 7517 JSON Web Key (JWK)</para>
     <para>&lt;<link xmlns:xlink="http://www.w3.org/1999/xlink"
         xlink:href="http://www.ietf.org/rfc/rfc7517.txt"
@@ -4596,6 +4600,9 @@
         <title>SetAuthorizationServerConfiguration</title>
         <para>This operation modifies an existing authorization server configuration. The device
           shall support this command if MaxConfigurations capability is greater than zero.</para>
+        <para>When the <literal>KeyID</literal> value of the configuration is set, the device shall
+          include that value in the <literal>kid</literal> header field of the client assertion defined
+          in RFC 7515 Section 4.1.4.</para>
         <variablelist role="op">
           <varlistentry>
             <term>request</term>