The principal

The principal says who you are, which ecosystem you are in, your email and your name, your region, what you are allowed to do, how strongly you were authenticated, and, when a persona is acting for you, who is acting and on whose behalf, and whether that action is gated. For a token it says which token, and which application.

Different kinds of request are let in by different checks: a session; a session or a persona's acting token; a route a persona may never call; a live stream, whose token travels in the address; a bearer token; a personal API token; an agent over MCP; Shipr; and the AI processing node. Whether you are an admin of the hub is decided by a list of admin email addresses, and shows up as one of the things you are allowed to do.