How would you answer an interview scenario involving claims-based authorization?

In an interview, I would first define claims-based authorization and the problem it solves, then explain how I would trust claims only from validated issuers, normalize claim meaning, keep sensitive authorization rules server-side, use policies to centralize logic, and avoid putting excessive mutable permissions directly into long-lived tokens. I would also call out the main failure mode: accepting client-supplied or unvalidated claims can let callers grant themselves privileges by changing request or token data. Finally, I would describe how I would test, monitor, and safely roll back or recover the solution.