# description
A first-class, user-controlled authorization that defines who may access which claims, for what purpose, under what constraints, and for how long.

# properties.allowed_claim_keys.description
If present, restricts access to only these keys. If omitted, access is bounded by namespace and domain only.