ID Token support clarification

[simon-canning-octopus]

Hi 👋, first time contributing so please direct me elsewhere if appropriate.

I believe GitHub Actions currently supports the model defined by this document and refers to it as 'Security hardening with OpenID Connect'. The tokens GitHub Actions issues are referred to as 'OIDC tokens' / 'ID Tokens'.

https://github.com/ietf-wg-wimse/draft-ietf-wimse-workload-identity-bcp/blob/3916596e1656d1d21108ca660bbf060a3b57b234/draft-ietf-wimse-workload-identity-bcp.md?plain=1#L204

Is there a reason/explanation behind why ID tokens must not be accepted? Is it to ensure the token (i.e., the sub) represents the workload identity, and not a user identity?

Aside/context: Within my organization, and our customer base, people refer to the pattern described as 'OIDC support' or 'OIDC federated identity'. We build a product in the CI/CD tooling space.