Editorial policy

Which sources do we use?

For how a product behaves, we cite the organization that runs it: GitHub for the claims in its tokens, AWS for IAM evaluation, Microsoft for Entra, Google for Google Cloud. For risks and attacks, we cite the published research and say who published it. Third-party tutorials are not used as evidence.

How are sources labeled?

• Official documentation (issuer): the party that creates the token or claim.
• Official documentation: the cloud provider that evaluates it.
• Official announcement: a changelog or blog post from the vendor.
• Vendor security research: findings published by a company that sells related products. We note that interest next to the citation.

Each source entry says what we read: the full page, or only part of it.

What about inference?

Where a guide draws a conclusion the sources don't state directly, it says so ("by inference"). We don't publish numbers we can't trace to a source.

How does the checker stay accurate?

Its rules follow the same documentation as the guides, and its matching logic has automated tests. It simulates part of each provider's evaluation; the page lists what it doesn't cover.

When does a page count as updated?

The "updated" date changes only for substantive edits: a corrected fact, a new section, a changed recommendation. Each change gets an entry in the page's update history. Typo fixes don't.

How often are sources rechecked?

At least once a quarter for the vendor pages the checker depends on, and whenever a vendor announces a change to token formats or trust evaluation.

Corrections

Send corrections to info@cloudidentitysecurity.com. Confirmed errors are fixed and logged in the update history.

Sponsorship and affiliate links

There are none today. If a sponsor is ever accepted, it will be labeled as such where it appears, it will have no say over guide content or checker rules, and this page will be updated first.