I don't think (a) is a practical possibility. It either requires the PEP to understand the policies that apply (which seems an undesirable lack of encapsulation) or for the PEP to provide all possible evidence with every request. I don't think this is feasible from a performance standpoint in a distributed environment. It also leads to behavior which is unacceptable from a user's point of view, for example, requiring unnecessary Authentication.

Assuming (b) I would be interested in understanding your specific concerns. Certainly integrity and confidentiality of the assertion can be provided if required.

There is a principle in an Authentication situation to avoid giving away information that would assist an attacker. However, I am not aware of a similar concern in the context of Authorization. In fact, it is frequently a requirement to accompany a negative response with an indicatication of how a user might be allowed access, for example by reauthenticating with a "stronger" method.

In the case of a positive response, I see no issue with informing the PEP (or subsequently a court of law) what criteria were used.