It’s an additional canister signature signed payload that can be sent along with a delegation created by a canister. This enables canisters to ingest additional metadata tied to the principal.
Currently focusing on identity attributes like emails, but could in theory be anything. For example user access control roles on a platform with multiple canisters.