Statement about a subject (user) contained in a security token. Examples include username, email, group memberships, and custom attributes used for authorization.