Nice article @scottpiper.bsky.social! At @vercel.com we designed our OIDC tokens to have customer scoped issuer and audience claims, while the subject is scoped to the project and environment. We designed it this way to help our customers avoid such mistakes with their trust policies.