# The principal

The principal is whoever is calling, once Jadpo has checked them: either a
**user** (a person) or a **service** (another system, such as a partner's
server). You declare it once in `app.jadpo`, with no name. It says which
stored record each kind of caller is, and when that record may still sign
in:

```jadpo
// app.jadpo
principal {
    user: {
        subject: User.authentication_subject
        active: User.status == UserStatus.active
    }
    service: {
        subject: Service.name
        active: Service.status == ServiceStatus.active
    }
}
```

## `subject:`

Jadpo needs to know which record a signed-in caller is. `subject:` names
the field it finds them by, such as `User.authentication_subject` or
`User.email`. The field must be unique. When your app has tenants (many
organisations sharing one app, see [Tenancy](tenancy.md)), it
must be a field every tenant shares, so one person is one record. Jadpo
looks the caller up by this field whenever it needs their current record.

## `active:`

`active:` is a condition on the same entity, written with its fields as a
query's `where:` is. A caller whose record doesn't meet it is refused with
`user_disabled` or `service_disabled` (see [Failures](identity-failures.md)).
Leave it out and every record counts as active.

## What code reads from the caller

The principal has three fields of its own, and no others:

- `id`: the record's `id`, a `User.id` or a `Service.id`;
- `subject`: the value of the `subject:` field;
- `strength`: how the caller proved who they are, `primary` or
  `multi_factor`.

A role, a tenant or an email address isn't on the principal. Code that
needs one reads it from the entity, which is where [Policy](policy.md)
reads it too.

## Users only

`service:` is optional. Most apps only have users, and leave it out. An
app needs at least one of `user:` and `service:`.