# Acting as a user

An action receives its caller, the person or service signed in, as a
typed parameter ([The principal](the-principal.md)). So a test
passes one in:

```jadpo
test "bob cannot complete alice's todo" {
    var alice: Principal.user = alice_with_todos()
    var bob: Principal.user = bob_with_no_todos()
    var todo: Todo = first_todo(alice)
    assert complete_todo(todo.id, bob) fails TodoNotFound
}
```

Here Bob tries to complete one of Alice's todos. Policy reports a record
the caller may not see as the same not-found failure as a record that
doesn't exist ([Concealing records](concealing-records.md)),
so the test checks exactly what Bob would see.

## Making a caller

Tests, fixtures and seeds make a user caller with `Principal.user(user)`,
and a service caller with `Principal.service(service)`. Application code
can't, because there a caller only comes from signing in.

## Signing in for a route test

A route test signs in with `as:`, which goes through the application's
real authentication. A service signs in with a key from
`Service.issue_key`. So a disabled user is refused exactly as in
production, and the sign-in checks are tested too.

## Calls with no caller

A call a test, fixture or seed makes runs as the caller it passes, as
`complete_todo` runs as Bob here. A call that passes none, such as one
setting up data, runs without policy. So a call with no caller proves
behaviour and data, and a route test or a call with a caller proves
[policy](policy.md).