Use autoconfirmed, if we can get that from OAuth; otherwise use some minimum account lifetime/editcount.
We should probably have a discussion (if that hasn't happened already) about whether this is desired behaviour, and if so what the account quality threshold should be. I don't know if it's likely but it's theoretically possible that a user might want to OAuth through an account that isn't their main account, in which case it may not meet the threshold even though their main account does.
At a minimum I think we should make this flexible, such that it could be changed by tool admins as needed.
Ok, no problem then. I think autoconfirmed (which is a user right denoting 4 days and 10 edits) should be the limit; that would prevent spam or trolling while trying to leave the platform open to as many as possible, even if they don't meet the strict requirements. We can discuss this next check-in though.