How does authoritativeGroups work on first use and first RP login?

[gene1wood]

1. How will a user have a authoritativeGroups list added to their user.app_metadata object? It looks like in the absence of the list no check is done but I don't see how the list is created and added to the user's user.app_metadata in the first place.
2. Assuming the authoritativeGroups list exists in the user's user.app_metadata object, how are new RP objects added to the list? It looks like lastUsed values are updated if the RP already exists in authoritativeGroups but I don't see how, when a user first logs into an RP which has a expire_access_when_unused_after value, what creates a new object for that RP in the user's authoritativeGroups list.