Structural validation only. The TENANT binding is checked separately by
assertExecutionPrincipal, because "is this shaped like a principal" and "is
this principal allowed here" are different questions and conflating them
produces call sites that answer neither.
This answers only "was a valid principal readable from this value". It does
NOT promise a later plain read returns what was validated — nothing can, for
an object built to lie. Anything that goes on to USE the fields must take
them from canonicalPrincipal's snapshot (as trustAutomationPrincipal and
assertExecutionPrincipal do) rather than from the argument.
Structural validation only. The TENANT binding is checked separately by
assertExecutionPrincipal, because "is this shaped like a principal" and "is this principal allowed here" are different questions and conflating them produces call sites that answer neither.This answers only "was a valid principal readable from this value". It does NOT promise a later plain read returns what was validated — nothing can, for an object built to lie. Anything that goes on to USE the fields must take them from
canonicalPrincipal's snapshot (astrustAutomationPrincipalandassertExecutionPrincipaldo) rather than from the argument.