Anyone ever integrate any of the Zanzibar implementations (authzed or keto) with Google Identity? I want to be be able to give users the ability to authorize other Google identities (Google Account, Service Account, Google Group, org, etc) to their resources. The problem I run into is you can't use a Google identity email as your Subject Reference because they can change. You're supposed to use the ID (

sub

claim in the JWT), and it's not possible (as far as I can tell) to access them just by email.