Vouch for an automated principal. Calling this IS the trust assertion, which
is why it is a named function rather than a cast: it should be greppable, and
it should never appear on a path that took the principal from a request.
Throws on a human or a malformed principal — those must use the
role-authorized entries.
Returns a CANONICAL CLONE, branded and frozen. Validating the caller's object
and handing the same reference back made the vouch time-of-check/time-of-use:
the caller kept a mutable alias, so a validated system principal could be
rewritten into {kind:'human', role:'admin'} after the check and before the
service read it — and #authorizeAutomated re-reads kind. The clone comes
from canonicalPrincipal, so it holds the exact values that were validated
and no extra property rides into the trusted computing base; the brand lets
consumers prove the value came from here, and the freeze keeps both true for
the object's whole life.
Vouch for an automated principal. Calling this IS the trust assertion, which is why it is a named function rather than a cast: it should be greppable, and it should never appear on a path that took the principal from a request.
Throws on a human or a malformed principal — those must use the role-authorized entries.
Returns a CANONICAL CLONE, branded and frozen. Validating the caller's object and handing the same reference back made the vouch time-of-check/time-of-use: the caller kept a mutable alias, so a validated
systemprincipal could be rewritten into{kind:'human', role:'admin'}after the check and before the service read it — and#authorizeAutomatedre-readskind. The clone comes fromcanonicalPrincipal, so it holds the exact values that were validated and no extra property rides into the trusted computing base; the brand lets consumers prove the value came from here, and the freeze keeps both true for the object's whole life.