This message was deleted.

Just to be clear, this isn't a segmentation of elevated or privileged accounts

Personally I think you are right about setting up trust and it being more secure in practical terms. That would be my choice too. Even if only for the practicality of accessing your work. Devil's advocate; I do think you would be more secure with segregated access as even if something malicious would penetrate (through credentials) identity1, it would not be able to do something on identity2 yet. In the end I would just setup trust and make sure that the credentials provided have all necessary security measures.

There have been attacks on domain trusts that let you take over every attached trusted domain if you manage to compromise a domain controller, so in terms of absolute security it makes sense.

Thanks gents - i don't buy into the fear of trusts being breached logic - those can be controlled and secured, and when it's resource forests trusting user forests it's not hard to limit - I'm not convinced multiple identities is really a decent security logic, I think securing environments and wrapping controls around the appropriate identity makes more sense, but I'm no security guy