Workload Identity Claims
Lints claims you paste against a policy you declare. It does not verify signatures, does not contact an identity provider and does not prove the token is genuine. Paste decoded claims only: anything shaped like a compact signed token is refused.
Run the lint to see a verdict.
Subject is a well-formed workload identifier in an allowed trust domain; audience present and matching; expiry present and within your declared lifetime; issued-at and not-before sane against the clock you supply; actor chain depth and each actor an identifier; authorized-actor consistency; for an exchange, scope a subset of the subject scope and audience or resource not wider. Claim values must be the type the claim expects: expiry, issued-at and not-before are whole seconds since epoch, audience, scope and resource are strings or lists of strings, and may-act is one actor object with a subject string; anything else, and any present-but-malformed scope, is refused or flagged with an explicit code. A claim the policy needs but the input lacks gives INDETERMINATE, never a guess.