The OidcAuthorizer (security remediation plan §6): privileged-operation authorization deferred to JWT scopes minted by the organization's identity provider, validated with Nimbus JOSE+JWT against a cached JWKS. Optional: fleets on the mtls profile use the MembershipAuthorizer and never load this module.