A company federates with a SaaS HR application using SAML 2.0. Employees authenticate to the corporate identity provider (IdP) and are then redirected to the HR application without re-entering credentials. During a security review, an architect must confirm which component is responsible for cryptographically vouching for the user's identity to the SaaS application. Which SAML role produces and signs the assertion that the SaaS application relies upon?