Assumable identities. Trust policy decides who can assume; attached policies decide what the session can do.