The valet key — read who you are and what you may do

Before you start

A control claims "access is authenticated and authorized." That truth does not live in a slide deck — it lives in the bytes the protocols carry: the claims you can decode out of a JWT, the short-lived token the OAuth dance hands you in place of a password, and the assertion fields a SAML IdP signs and an SP must read before it trusts you. You are handed real identity artifacts and asked to read each claim's truth directly off them, then diagnose the single field where a real tampered twin contradicts its claim. Every value you reveal is the real parser / state-machine over the real artifact — the same JSON a base64url decode produces with no key, the same dance order a conformant authorization server accepts, the same window an SP computes against "now." Nothing is invented; the decode is the answer key. Start on the "JWT · header.payload.signature" panel.