How should claims-based authorization be designed for production?

For production, trust claims only from validated issuers, normalize claim meaning, keep sensitive authorization rules server-side, use policies to centralize logic, and avoid putting excessive mutable permissions directly into long-lived tokens. Add automated tests and observability around the critical behavior, document ownership and failure handling, and review the design when traffic, dependencies, or security requirements change.