[Intro] Yo, check it, check it (ad-lib) Pod a run wid token inna hand Dem seh it safe, but mi seh, understand [Verse 1] Reporting pod mount im service-account token tight Send it to di endpoint, deployment one, a wrong yuh might Exchange go through, next request run Deployment role permissions, dat's di damage done Second trust read di aud claim, bwoy Audience match, identity inna di joy [Chorus] Nuh assume, check di audience! (Crew: Check it!) Bind it when yuh issue it, bind it when yuh accept! Wrong audience, wrong workload, mek dem get reject! Nuh assume, check di audience! (Crew: Check it!) Recipient and workload, two decisions, not one set! [Verse 2] Rotation good, but rotation nuh mean safe Short-lived token still can wander if di trust a fail Default nuh mean universal, yuh hear me clear Cluster location nuh di boundary, nuh fi trust it here Issuer trust nuh pick di right workload fi yuh Subject name must match, nuh guess, verify it through [Bridge] (percussion only, spoken) Issue it for di intended one. Accept it only from di one. Then test di wrong audience, Test di wrong workload, And mek di rejection hold. [Chorus] Nuh assume, check di audience! (Crew: Check it!) Bind it when yuh issue it, bind it when yuh accept! Wrong audience, wrong workload, mek dem get reject! Nuh assume, check di audience! (Crew: Check it!) Recipient and workload, two decisions, not one set! [Outro] Audience! (Crew: Workload!) Audience! (Crew: Workload!) Nuh assume... check it, bwoy, check it fi real
