Looking at a method such as:
How does the access token content (Authorization — Daml SDK 2.2.0 documentation) get used vs the provided actAs/readAs?
You must explicitly say what parties are you acting or reading on behalf of. The token is essentially taken as opaque and passed as is to the Ledger API server that will validate the provided claims against the token, meaning that each set of provided parties must be a subset of the ones listed in the token. This allows to use tokens associated with a variety of claims but issue commands and read transactions only with the party (or parties) that are relevant for your application.
Great. Thank you for the clear and concise details!
1 Like