Defined as part of policies, these determine the circumstances under which a policy applies. Environmental conditions reflect circumstances, such as the client's IP address, time of day, how the subject is authenticated, or the authentication level achieved. Subject conditions reflect characteristics of the subject, such as whether the subject is authenticated, the identity of the subject, or claims in the subject’s JSON Web Token (JWT).