ASP.NET Core is adding new metrics in the next version for authentication and authorization. These should be documented in the semantic conventions.