Audience Restriction
One token is offered down three service lanes at once and only the lane with an open gate carries it through to the service.
CSS
Authz
15 animationsClaim Unpacking
An encoded token reads as three segments and its payload drops three claim rows out in order down the indent guide.
CSSCode Exchange
A short authorisation code crosses from the client rail to the token endpoint and a longer access token returns along the lower rail to rest in the client's store.
CSSDelegated Handoff
A token hops along three services and the actor chain below gains an abutting segment at each hop.
CSSField Consent
Four requested fields are consented one at a time, each tick drawing in its box while the matching quarter of the grant meter extends below.
CSSIdle Timeout
A fixed idle window jumps forward onto each activity mark as the now rule reaches it, then lapses when the rule runs out past its far edge.
CSSPolicy Evaluation
Subject, action and resource guides draw inward to a decision node, which then writes the verdict bar along the output rail.
CSSRefresh Overlap
Two validity intervals sit on one time rule and a now rule sweeps them, lighting the refreshed interval before the current one goes dark so coverage never breaks.
CSSRevocation Propagation
A revocation leaves the issuer along four spokes and each live session bar retracts to nothing as the pulse reaches it.
CSSRole Resolution
A role record fans out to three permission slots, each branch lighting in turn before its permission bar draws across the slot behind it.
CSSScope Narrowing
A selection band bracketing six granted scopes closes onto the two that survive delegation while the other four retract to nothing.
CSSSession Lifetime
A session window dimensioned on a time rule is consumed from its leading edge until it reaches the expiry mark and a fresh lifetime is issued.
CSSSigner Rotation
The active band grows to cover both verification slots for the grace window, then retracts from the top onto the new slot.
CSSStep-Up Challenge
An assurance marker on the first tread is challenged and climbs to the second, carrying the projected level rule up with it.
CSSToken Introspection
A presented token slides into register with the issuer's record, comparison guides come up between the notches, and an active flag is written into the result slot.
CSS