Event Subject Claim

[dickhardt]

Do we specify how a subject is included in a SET or let profiles define that?

The current draft draft-ietf-secevent-token-03 defines the sub claim as an optional string or URI, with semantics left to the profile. This claim is placed in the SET envelope. No "subject" claim is defined inside the event object, which means that profiles are free to define such claims as they see fit.

Alternatively, we could have an event_subject claim inside the event object, with a "SHOULD" normative status.