On demand Cert authentication - how is the client cert vaidated ?

ODCA on its own doesn't do much more than validate the Certificate is from a trusted CA, exists, and is not expired.

If you want proper validation, you need to add OCSP or CRL validation after the ODCA agent.