# Who is calling: `current_principal`

A route reads the signed-in caller as `current_principal`, and passes it
to the action it runs like any other argument. `current_principal.user`
says the route is for users only: it is a `Principal.user`, and a service
calling the route is refused with 403 before the action runs.
`current_principal.service` works the same way for services.

```jadpo
// domains/planning/actions/create_todo.jadpo
action create_todo(input: CreateTodo, caller: Principal.user) fails DueDateInPast -> TodoView {
    var owner: User.id = caller.id
    ...
}

// domains/planning/routes/todos.jadpo
POST / {
    input: CreateTodo
    output: TodoView
    run: create_todo(input, current_principal.user)
}
```

The route is written as [HTTP](http.md) describes.

- `current_principal` exists only in routes that need a signed-in caller.
  Actions, queries and functions get the caller as a parameter, so their
  signatures say they need one, and tests pass one in.
- An action that only needs policy's checks takes no caller.
  [Policy](policy.md) reads the caller from the request itself.
- A schedule or a subscriber has no caller, so an action it runs can't ask
  for one ([Jobs and events](jobs-and-events.md)).
- A caller can never be returned to a client, read from request input or
  put in a failure's fields (`type.auth_principal_*`), however deeply a
  field holds it: in a list, a map or an option, or in an object's field
  or a variant's data.