Authentication map: where does workflow go?

[sattvik]

Hello,

I am implementing a new workflow and am a bit confused by an apparent conflict between the README and the provided workflows. The README states that the authentication map should contain a ::friend/workflow entry identifying the workflow. However, it seems like the provided implementations add this to the authentication map metadata, not the authentication map itself. Which is the correct way?