The new Authentication Policy should expose a request.auth.claims attribute. See: https://preliminary.istio.io/docs/concepts/security/authn-policy.html.

However, this attribute hasn't been defined for Mixer. I get an error attempting to use it (in 0.7.1, 0.8, and HEAD):

2018-04-18T00:20:16.772654Z error Unable to initialize adapter: snapshot='6', handler='apigee-handler.apigee.istio-system', adapter='apigee', err='cannot infer type information from params in instanceConfig 'apigee.authorization.istio-system': failed to evaluate expression for field 'Subject'; failed to evaluate expression for field 'Subject.Properties[encoded_claims]'; unknown attribute request.auth.claims’.

This attribute is a must-have for me to use the policy. Thanks!