
After providing some details in an earlier on a question from James McGovern, I happened to take a gigantic jar of coins that I keep around (with all my loose change) into my local bank. What happened next further enlightens James' questions regarding claims versus roles.
I took a large jar of coins into my local bank, where they have a tall cylinder that lets you dump a bunch of coins in the top in exchange for the denomination you choose. You simply walk into the bank and dump the coins in. No authentication, no authorization, no roles. The bank audits access through monitoring of course, but the access is not authenticated as such. The coin service is free if you are a bank customer, but they charge you about 9% (ouch!) if you are not a customer.
So I dump the big jar of coins in. The machine does same basic validation. Canadian coins (aka the Northern Peso) stick to the side so that I can remove them.
The machine gurgles away for a while, and then spits out a receipt. The bank (service provider) so far has had no involvement other than letting me in the door. The value of my jar of coins has been transferred onto the receipt (token) that the machine spit out. The token is timestamped and says the bank owes $109 (if I am a bank customer) or about $100 (if I am not a customer).
Now it is up to me to protect the token. I have to walk about 8 feet over to the teller. The bank up to this point has next to no risk in the transaction. Their machine has the money, if I lose the ticket/token I am out $109 and they are up $109.
When I get to the teller, she asks for the ticket -- I could give her nothing else and still get $100! No role, no mapping my identity to the coins or the token. If I want the 9 bucks extra (and I do) I need to show an ATM card (which they interestingly enough did not ask me to authenticate via PIN). At this point based on the fact that I am a bank customer I get 9 bucks more, this $9 is the only difference in this scenario, between an anonymous, no identity required transaction and authorized customer transaction.
In no case was my identity mapped onto the coins, it was mapped onto the token for a very brief 2 minute window. being a bank customer could be described as a claim/assertion in a group or role membership or simply as an attribute. The service provider and PEP has a number of ways to mitigate its own liabilities, and ultimately the riskiest part of the transaction is the service requester losing the token after the value has been exchanged.
The coin exchanged is WS-Trust - style STS. The subject/object mappings are centered on the request, the value and token, not on mapping subjects directly to objects.
Let's go back to 1670 -- from Quicksilver:
The heat was too much. He was out in the street with Uncle Thomas, bathing in cool air.
"They are still warm!" he exclaimed.
Uncle Thomas nodded.
"From the Mint?"
"Yes."
"You mean to tell me that the coins being stamped out at the Mint are, the very same night, melted down into bullion on Threadneedle Street?"
Daniel was noticing, now, that the chimney of Apthorp's shop, two doors up the street, was also smoking, and the same was true of diverse other goldsmiths up and down the length of Threadneedle.
Uncle Thomas raised his eyebrows piously.
"Where does it go then?" Daniel demanded.
"Only a Royal Society man would ask," said Sterling Waterhouse, who had slipped out to join them.
"What do you mean by that, brother?" Daniel asked.
Sterling was walking slowly towards him. Instead of stopping, he flung his arms out wide and collided with Daniel, embraced him and kissed him on the cheek. Not a trace of liquor on his breath. "No one knows where it goes--that is not the point. The point is that it goes--it moves--the movement ne'er stops--it is the blood in the veins of Commerce."
"But you must do something with the bullion--"
"We tender it to gentlemen who give us something in return" said Uncle Thomas. "It's like selling fish at Billingsgate--do the fish wives ask where the fish go?"
"It's generally known that silver percolates slowly eastwards, and stops in the Orient, in the vaults of the Great Mogul and the Emperor of China," Sterling said. "Along the way it might change hands hundreds of times. Does that answer your question?"