Which of the following code examples inserts a may_act claim to the resulting token in a PingAM implementation?

In PingAM's OAuth 2.0 scripting, the requestedToken object represents the token that is being created and will be issued. The addMayAct(mayAct) method is the specific API call available on this object to insert the mayact claim, which is used for delegation in token exchange scenarios as defined by RFC 8693. The mayAct variable passed to the method must be a JSON object containing the claims for the party that is authorized to act on behalf of the subject.

A. var mayAct = ... token.addMayAct(mayAct): The token object typically represents the incoming or original token, not the new token being issued, making this the incorrect object to modify.

C. var mayAct = ... requestedToken.setMayAct(mayAct): The correct method name in the PingAM scripting API is addMayAct, not setMayAct.

D. var mayAct = ... token.setMayAct(mayAct): This uses both the incorrect object (token) and an incorrect method name (setMayAct).

PingAM Documentation, "Scripts Guide" -> "Scripting API" -> "RequestedToken (Scripting API)". The API documentation lists addMayAct(Object mayAct) as a method on the RequestedToken object, used to "Add the mayact claim to the token." This object is explicitly used in OAuth 2.0 access token modification scripts.