Client Scope & Claim GovernanceDefault-deny ownership and evidence boundaries for attribute token claims