undefined => no identity => 401. Throws TenantResolutionError when an
authenticated actor carries an invalid tenant ID or names a reserved
identity ('system') — either is a verifier or claim-mapping bug, surfaced
as 403 by the routers, never concatenated into a runId ("undefined" is
itself a pattern-valid string, so an unvalidated String(undefined) would
silently authorize a tenant literally named 'undefined').
undefined => no identity => 401. Throws TenantResolutionError when an authenticated actor carries an invalid tenant ID or names a reserved identity ('system') — either is a verifier or claim-mapping bug, surfaced as 403 by the routers, never concatenated into a runId ("undefined" is itself a pattern-valid string, so an unvalidated
String(undefined)would silently authorize a tenant literally named 'undefined').