A federated login trust points at the correct issuer while the downstream application still enforces the old audience or group claim mapping during a staged decommission

Authentication succeeds at the identity edge and authorization fails where claims are interpreted differently. The service still works through the primary path, but one dependency only fails when the old component is finally drained away.