The registered claim names are more or less clear. If I got it right, these are addressed to provide JWT specification with a set of claims out of the box. 1
Claim Names can be defined at will by those using JWTs. However, in
order to prevent collisions, any new Claim Name should either be
registered in the IANA "JSON Web Token Claims" registry established
by Section 10.1 or be a Public Name: a value that contains a
Collision-Resistant Name. In each case, the definer of the name or
value needs to take reasonable precautions to make sure they are in
control of the part of the namespace they use to define the Claim
Private Claim Names are subject to collision and should be used with caution.
What does collision mean in this context? How can claim names collide when there is only one authentication and authorization provider? Are not these providers aware of the claims they populate and verify?
Could it be possible that a secondary auth provider could change the JWT payload so that it could override some of these claims?
Probably, I'm missing something important regarding the authentication and the authorization workflow, but I don't know what. Or maybe I'm not getting the definition of collision because of my limited English skills.
1: I have checked out a couple of JWT APIs in Java and I have confirmed that these claims can be informed through dedicated methods/functions (unlike public o private claims whom are informed like a tuple key-value).