Swap shared secrets for signed tokens from your identity provider, let in only known networks, and allow a browser app on another origin, all with included policies.