So now we have come back to the question, does proving my age is
over 18 authorise me to purchase alcohol in the UK?
If the user designates the resource with a credential that includes authorization, you have combined designation with authorization, and there is no confused deputy. If the user designates the resource with something, such as a credential that does not include authorization, then you've separated designation from authorization, and there is the potential for a confused deputy.
--------------
Alan Karp