I actually learned something from the previous thread. My users have a global ID (UUID) that comes from another system. I was initially going to put that into the traits. But it sounds like metadata_public would be the correct place instead? My users “register” via OIDC ID token through the hook. And a mapper sets the global ID trait. However, I just discovered in my testing that they can use the registration flow directly and set this global ID to a different value. What I really want is that users can never access the registration API directly. But it appears this is required for the OIDC flow. And I want this ID to only come via the ID token. Thus ID is also the subject of the ID token.