A failure mode that is common in many shared identity providers is that the services using the IdP often are able to ask for and receive information that should

A failure mode that is common in many shared identity providers is that the services using the IdP often are able to ask for and receive information that should generally not be seen as mandatory shared information. A simple example of this is email address. Giving the same email address to many companies generally means that eventually that address will end up on spam lists. This is a one way non-recoverable situation (once you're on the list, that email is burned), with a probability of it happening scaling approximately linearly with the count of services that use the same address. The impact scales in the same proportion (if you choose to disable the address, then you have to change with all the services). This is not theoretical. Services that use GitHub auth do this regularly.