I've seen a few "Best Current Practise" RFC's around standards implementation. eg: here's one still in draft form for OAuth: https://datatracker.ietf.org/doc/

I've seen a few "Best Current Practise" RFC's around standards implementation. eg: here's one still in draft form for OAuth: https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics https://datatracker.ietf.org/doc/html/draft-ietf-oauth-secur...