A skill and a parent bot should be able to validate that the caller is in the allowed list.
To support this capabilities we are adding a ClaimsValidator abstract class used by AuthenticationConfiguration that gets invoked after all the auth checks have passed and allows the developer to write code to validate the claims in the request.
Tracking Status
Dotnet SDK (Tracked in 2970)
Javascript SDK (Tracked in 1416)
Python SDK (Tracked in 434)