For CI/CD federated identity, what truly determines who can reach the production environment is the configuration string in the OIDC trust policy, rather than traditional credential management.