LHA Consulting, Incorporated

http://blogs.msdn.com/card/archive/2010/01/08/introduction-to-token-issuance-authorization-in-ad-fs-2-0-rc.aspx

Token Issuance Authorization, new feature in the ADFSv2 release candidate. Allows the Identifying Party STS to control which users are authorized to receive tokens, thus decoupling both AuthN as well as certain aspects of AuthZ from the Relying Party.

From the blog post, in describing a scenario in which Contoso users are accessing a Fabrikam online store:

With the new token issuance authorization feature, the administrator of the Contoso STS can create a policy that authorizes token issuance to Fabrikam based on membership in an Active Directory security group. This implements a form of role based access control (RBAC) at the STS. The administrators of the Fabrikam online store need not be aware of the details of the [Contoso] access control policy and no action is required from the vendor if the [Contoso] policy changes.