Authorize reads the cookie session and the same actor facts the /App policy reads; sub = UserAccount.Id, preferred_username = NormalizedBifrostIdentity. OpenIddict request caching parks the authorize request as a short request_uri. Mapped only when Bifrost:Oidc is present.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>