What must the trust policy of a role used with EKS Pod Identity allow?

Why this is the answer

Pod Identity roles are trusted by an AWS service principal, and TagSession must be allowed alongside AssumeRole because EKS attaches session tags when it assumes the role — leave it out and the association fails even though the role looks correct. Option two is the IRSA trust policy, which is the whole difference between the two mechanisms: no OIDC provider is involved here. The node role never assumes the Pod's role, and GetFederationToken is unrelated to either.