OptionalattributesDynamic context attributes (e.g. tenantId, farmId, ipAddress)
OptionalemailOptional email address
Unique user, service account, or agent identifier
OptionalpermissionsOptional fine-grained permission claims
Assigned role identifiers
OptionalsubjectSubject kind (defaults to 'human' if not specified)
Authenticated user or M2M agent security context passed into the RBAC engine.