Extensible Access Control Markup Language. How to define roles

1. IAM Policy
JWT.Groups = Tap-Admin Policy:
Selection Criteria : Subject.RoleIds in “tap-admin” (Mandatory)
Selection Criteria : Subject.Issuer = “PUBLIC” ( Advanced mode )
Selection Criteria : Subject.Audience = “MS-PAYMENT” ( Advanced mode )
Condition: Resource.id = “customer”
Condition: Resource.Action.id = “Delete”
Result : allow

2. Browser Apps
App
+Authn
Companion
Authn
Cookie
Fp: generated locally would need to be strore in DBX device store