Safely roll out OIDC authentication for user API traffic.

Rollout Steps

1. Enable OIDC config in a non-production environment.
2. Verify issuer/audience mapping and actor/project claim mapping.
3. Run in dual mode (OIDC + internal secret user headers) during migration.
4. Monitor 401/403 rates and permission-denied logs.
5. Gradually shift user traffic to OIDC bearer tokens.

Rollback

• Disable OIDC config flags and revert to internal-secret header path.
• Keep API keys and service-to-service flows unchanged.