It should be possible to configure which claims and which regex expression allow a user to pass to the upstream cluster.