Evaluate the sender-constraint matrix for one token: does the binding
presented on this request satisfy the token's cnf claim?
cnf is the RAW claim value straight off the JWT payload — validation of
its shape is this function's job. binding is the request's resolved
TokenBinding (or null/undefined when no mechanism produced one).
Each member is compared only against a binding whose kind owns it (see
BINDING_PROFILES): the Confirmation union is
mechanism-extensible, so a non-DPoP mechanism emitting { jkt: "..." }
(or a non-mTLS mechanism emitting { "x5t#S256": "..." }) could
otherwise satisfy a bound token without actually presenting the right
proof. Restricting each member to its declared mechanism enforces the
kind boundary structurally, not by convention (PR #185 / Codex
Important #2).
Evaluate the sender-constraint matrix for one token: does the binding presented on this request satisfy the token's
cnfclaim?cnfis the RAW claim value straight off the JWT payload — validation of its shape is this function's job.bindingis the request's resolvedTokenBinding(ornull/undefinedwhen no mechanism produced one).Each member is compared only against a binding whose
kindowns it (see BINDING_PROFILES): theConfirmationunion is mechanism-extensible, so a non-DPoP mechanism emitting{ jkt: "..." }(or a non-mTLS mechanism emitting{ "x5t#S256": "..." }) could otherwise satisfy a bound token without actually presenting the right proof. Restricting each member to its declared mechanism enforces the kind boundary structurally, not by convention (PR #185 / Codex Important #2).