Repository navigation

Refuse an OIDC exchange when two trust policies give one token different authority - #3811

Draft

dawsontoth wants to merge 5 commits into

mainfrom

claude/oidc-ambiguous-match

Draft

Refuse an OIDC exchange when two trust policies give one token different authority#3811
dawsontoth wants to merge 5 commits into
mainfrom
claude/oidc-ambiguous-match

Commits on Oct 30, 2026
- Refuse an OIDC exchange when two trust policies give one token different authority
  
  dawsontoth
  and
  claude
  committed
  caedcbe
- Count only a preview rival the exchange would refuse, and say why a broad policy is ignored
  
  dawsontoth
  and
  claude
  committed
  8939e5d
- Give each component in the deploy setup integration test its own environment
  
  dawsontoth
  and
  claude
  committed
  7eb2457
- Recheck for a conflicting policy just before setup writes, and skip rows the exchange ignores
  
  dawsontoth
  and
  claude
  committed
  283636b
- Name the rival policy and its user separately in the setup refusal
  
  dawsontoth
  and
  claude
  committed
  ae4f404