implementing workload identity federation. how hard can it be? i'm sure the token exchange will be super straightforward because IdPs all provide a small set of uniform claims, and it won't be necessary to use an expression language to deal with them, right?