Cross-boundary Workload Identity

[PieterKas]

Perhaps consider using similar terminology as in the OAuth cross-domain authorization draft? Also worth cosnidering using languagge like "Trust boundary" instead of "administrative boudnary" as different trust domains may be administered by the same entities, but trust is segmented on purpose to minimise blast radius in cases of compromise etc.