diff --git a/app/models/oauth2_provider_models_activerecord_authorization.rb b/app/models/oauth2_provider_models_activerecord_authorization.rb
new file mode 100644
index 0000000000000000000000000000000000000000..1bbb9b758c9d52d6e5976ac647099b080ec42ccc
--- /dev/null
+++ b/app/models/oauth2_provider_models_activerecord_authorization.rb
@@ -0,0 +1,4 @@
+class OAuth2::Provider::Models::ActiveRecord::Authorization
+  validates_presence_of :resource_owner_id, :resource_owner_type
+  validates_uniqueness_of [:resource_owner_id, :resource_owner_type] , :scope => :client_id
+end
diff --git a/db/migrate/20110526184644_add_oauth2_tables.rb b/db/migrate/20110526184644_add_oauth2_tables.rb
index 4d6b87fe4ba9e3fbe8dc43fe7732569f72dc7df2..d01744291f4ee6665b70a47f0bb89e41624c2be9 100644
--- a/db/migrate/20110526184644_add_oauth2_tables.rb
+++ b/db/migrate/20110526184644_add_oauth2_tables.rb
@@ -32,9 +32,13 @@ class AddOauth2Tables < ActiveRecord::Migration
       t.datetime 'created_at'
       t.datetime 'updated_at'
     end
+
+    add_index "oauth_authorizations", ["resource_owner_id", "resource_owner_type", "client_id"], :unque => true, :name => "index_oauth_authorizations_on_resource_owner_and_client_id"
   end
 
   def self.down
+    remove_index "oauth_authorizations", ["resource_owner_id", "resource_owner_type", "client_id"]
+
     drop_table 'oauth_access_tokens'
     drop_table 'oauth_authorizations'
     drop_table 'oauth_authorization_codes'
diff --git a/db/schema.rb b/db/schema.rb
index a28f87267ce8d01eff7062553792a15f2c5982e8..f1bf369b8aa1cd8c7d7de8f82fcb0309549a9a5c 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -221,6 +221,8 @@ ActiveRecord::Schema.define(:version => 20110614005205) do
     t.datetime "expires_at"
   end
 
+  add_index "oauth_authorizations", ["resource_owner_id", "resource_owner_type", "client_id"], :name => "index_oauth_authorizations_on_resource_owner_and_client_id"
+
   create_table "oauth_clients", :force => true do |t|
     t.string "name"
     t.string "oauth_identifier", :limit => 32, :null => false
diff --git a/spec/models/oauth2_provider_models_activerecord_authorization_spec.rb b/spec/models/oauth2_provider_models_activerecord_authorization_spec.rb
new file mode 100644
index 0000000000000000000000000000000000000000..7c69f83b91825113e380c4a6e67a7d965a828433
--- /dev/null
+++ b/spec/models/oauth2_provider_models_activerecord_authorization_spec.rb
@@ -0,0 +1,23 @@
+#   Copyright (c) 2010, Diaspora Inc.  This file is
+#   licensed under the Affero General Public License version 3 or later.  See
+#   the COPYRIGHT file.
+#
+require 'spec_helper'
+
+describe OAuth2::Provider::Models::ActiveRecord::Authorization do
+  describe 'validations'do
+    before do
+      @client = OAuth2::Provider::Models::ActiveRecord::Client.create!(:name => "APP!!!")
+    end
+
+    it 'validates uniqueness on resource owner and client' do
+      OAuth2::Provider::Models::ActiveRecord::Authorization.create!(:client => @client, :resource_owner => alice)
+      OAuth2::Provider::Models::ActiveRecord::Authorization.new(:client => @client, :resource_owner => alice).valid?.should be_false
+    end
+
+    it 'requires a resource owner for an authorization' do
+      OAuth2::Provider::Models::ActiveRecord::Authorization.new(:client => @client).valid?.should be_false
+    end
+  end
+end
+
diff --git a/spec/models/oauth2_provider_models_activerecord_client_spec.rb b/spec/models/oauth2_provider_models_activerecord_client_spec.rb
index 6acf772f16b92b74f12acd56275ff33eb57cb77c..b0a11fd84d9f5b07441f700e5645ed25a4327a4f 100644
--- a/spec/models/oauth2_provider_models_activerecord_client_spec.rb
+++ b/spec/models/oauth2_provider_models_activerecord_client_spec.rb
@@ -5,9 +5,11 @@
 require 'spec_helper'
 
 describe OAuth2::Provider::Models::ActiveRecord::Client do
-  #TODO
   describe 'validations'do
-    it 'is pending for now'
+    it 'validates uniqueness on identifier' do
+      OAuth2::Provider::Models::ActiveRecord::Client.create(:oauth_identifier => "three")
+      OAuth2::Provider::Models::ActiveRecord::Client.new(:oauth_identifier => "three").valid?.should be_false
+    end
   end
 end