Four questions instead of one “authenticated” flag
- Identity: what evidence identifies the subject?
- Attributes: which claims are available and in which versioned context?
- Policy: which rule set evaluates the requested action?
- Execution: which component owns the final action and its effects?
Why the separation matters
Keeping these controls distinct avoids treating a valid credential as universal authorization and keeps external evidence separate from application-specific policy.
What this page explicitly does not claim: The architecture does not establish general OIDC or federation support, ZETA conformance, identity-provider status or authorization correctness for every deployment.