> >contents of the "SSO Assertion".
I agree that this is absurd on the face of it.
> "whatever you do, don't keep this around" might be useful.
The use case I have in mind is an Authorization Decision Assertion which is derived from a policy which is time-based or otherwise volatile. Currently this is only available via the SOAP binding, but could be defined in other Profiles in future.