Do not accept external identity claims without explicit boundary tags on every attribute. Once the token arrives, the receiving service has no reliable way to know which source domain originally controlled that data point.
Federation agreements usually stop at signature validation. They rarely carry forward the residency or scope restrictions that applied at the issuing identity provider.
The result is silent expansion. An attribute pulled from a partner directory lands in your authorisation decision with the same weight as one minted inside your own controlled environment.
Procurement teams negotiate the contract on paper. Delivery teams then wire the IdP connection and discover that every claim flows through without additional gating.
Audit logs record successful assertions but omit the original trust context. When a later breach investigation asks which boundary allowed the access, the trail stops at the federation endpoint.
Reset the integration to require per-claim provenance headers before any production traffic is permitted. That single change forces the question of residency and scope back into the design conversation.
Without it, every new partner connection quietly widens the surface that security must defend while the contract language stays unchanged.