ctrlrun.ApproverIdentity — class, defined at src/ctrlrun/approval.py:201
Control built without one behaves exactly as 0.7.0 did;
one built with it refuses any approval whose row carries no VerifiedApprover, wherever
that approval came from and whatever the store did with the column.
A second instance of v0.3’s IdentityProvider and never the agent’s: the agent’s provider
reads what a proxy set for the agent, and a deployment where one object answers both doors
is one where the agent’s own token can grant the agent’s own approvals.
roles_claim names the claim this issuer puts roles in (§3.4). It lives here because it is
a property of the issuer and not of any one surface: the operator MCP server reads it where
--approver-roles-claim does not override it, and a surface that reads neither holds no
roles and so satisfies no control that names one.