What is a common mistake when working with claims-based authorization?

A common mistake with claims-based authorization is accepting client-supplied or unvalidated claims can let callers grant themselves privileges by changing request or token data. The safer approach is to design and test the behavior explicitly rather than assuming the platform or dependency will handle it automatically.