Discussion on this issue continued in slack and on Github. The issue turned out to be with our docs having an outdated section, which we’ll fix shortly.
The outdated section shows example JWT claim headers in the form x-pomerium-authenticated-user-{email|user-id|groups}, but the format is actually x-pomerium-claim-{email|user-id|groups}.
