}

	var policyBuf []byte
	if opts.sessionPolicy != nil {
		err := opts.sessionPolicy.Validate()
		if err != nil {
			return auth.Credentials{}, time.Time{}, err
		}
		policyBuf, err = json.Marshal(opts.sessionPolicy)
		if err != nil {
			return auth.Credentials{}, time.Time{}, err
		}
		if len(policyBuf) > maxSVCSessionPolicySize {

			policyBuf, err := json.Marshal(opts.sessionPolicy)
			if err != nil {
				return updatedAt, err
			}

			if len(policyBuf) > maxSVCSessionPolicySize {
				return updatedAt, errSessionPolicyTooLarge
			}

			// Overwrite session policy claims.
			m.Set(policy.SessionPolicyName, base64.StdEncoding.EncodeToString(policyBuf))