As specified [here](https://github.com/reTHINK-project/specs/issues/21). It may require somehow an extension of the policy engine in order to have access to required information from the Id Token. At the end give examples policies to be enforced for this purpose.
