diff --git a/spec/index.bs b/spec/index.bs
index 9e4b2bc8..8ba92d0c 100644
--- a/spec/index.bs
+++ b/spec/index.bs
@@ -460,6 +460,10 @@ To <dfn>compute the connection status</dfn> given an {{IdentityProviderConfig}}
 {{IdentityProviderAccount}} |account|, and a |globalObject|, run the following steps. This returns
 <dfn for="compute the connection status">connected</dfn> or
 <dfn for="compute the connection status">disconnected</dfn>.
+    1. If |account| [=map/contains=] {{IdentityProviderAccount/approved_clients}} and
+        |account|'s {{IdentityProviderAccount/approved_clients}} does not [=list/contain=]
+        |provider|'s {{IdentityProviderConfig/clientId}}, return
+        [=compute the connection status/disconnected=].
     1. Let |configUrl| be the result of running [=parse url=] with |provider|'s
         {{IdentityProviderConfig/configURL}} and |globalObject|.
     1. Let |idpOrigin| be the [=url/origin=] corresponding to |configUrl|.