sub claim

Also written: sub, subject

The part of an OIDC token naming where the run came from, such as `repo:kettleandcrane/shop:ref:refs/heads/main`. The cloud's trust condition matches against it.