When configuring a cloud provider to trust GitHub's OIDC tokens, why might you customize the token's subject (sub) claim format?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Customizing OIDC sub claims lets cloud trust policies match repo, ref, or environment, reducing which workflows can mint cloud credentials.
Full explanation below image
Full Explanation
GitHub Actions OIDC issues short-lived JWTs for cloud federation. Providers match claims like sub, repository, environment, and job_workflow_ref. Organizations can customize subject claim templates for uniqueness and filtering. This is unrelated to GITHUB_TOKEN PAT scopes or badge rendering. Without tight claim conditions, any workflow in a trusted repo might assume powerful roles. Combine id-token: write permission, cloud provider trust policy, and environment names in sub for deploy isolation.