diff --git a/beps/0003-auth-architecture-evolution/README.md b/beps/0003-auth-architecture-evolution/README.md
index 6c8aa38b0b..e5937aab0d 100644
--- a/beps/0003-auth-architecture-evolution/README.md
+++ b/beps/0003-auth-architecture-evolution/README.md
@@ -111,6 +111,8 @@ type BackstageCredentials =
 export interface AuthService {
   authenticate(token: string): Promise<BackstageCredentials>;
 
+  // TODO: should the caller provide the target plugin ID?
+  // TODO: how can we make it very difficult to forget to forward credentials
   issueToken(credentials: BackstageCredentials): Promise<{ token: string }>;
 }
 ```