[Reference](/docs) · by task

# Sign people in and decide who sees what

Sessions, magic links and passkeys; then grants, roles, tenancy and the permissions report. Read them in this order. Each page links to the pages around it.

1.  [The principal](/docs/the-principal)
    
    The principal is whoever is calling, once Jadpo has checked them: either a user (a person) or a service (another system, such as a partner's server).
    
2.  [Ways to sign in](/docs/ways-to-sign-in)
    
    `authentication { }` in `authentication.jadpo` lists the ways your app lets a caller prove who they are.
    
3.  [Magic links](/docs/magic-links)
    
    A magic link signs a person in by email, with no password.
    
4.  [Passkeys](/docs/passkeys)
    
    A passkey lets a person sign in with their fingerprint, their face or their device's PIN, with no password and no email to wait for.
    
5.  [Routes: signed in by default](/docs/routes-signed-in-by-default)
    
    Every route needs a signed-in caller unless it says otherwise.
    
6.  [Who is calling: current\_principal](/docs/who-is-calling-current-principal)
    
    A route reads the signed-in caller as `current_principal`, and passes it to the action it runs like any other argument.
    
7.  [Grants](/docs/grants)
    
    A grant says who may do one thing to an entity's records.
    
8.  [A user field on the record](/docs/a-user-field-on-the-record)
    
    Use a user field when a record belongs to one person, such as a todo and its owner.
    
9.  [A membership role](/docs/a-membership-role)
    
    Use a role when people get access by belonging to something, such as the editors of a company.
    
10.  [Tenancy](/docs/tenancy)
     
     Use tenancy when your app is shared by many customer companies, so that one company never sees another's data.
     
11.  [Field restrictions](/docs/field-restrictions)
     
     A field follows its entity's grants unless it says otherwise.
     
12.  [When policy says no](/docs/when-policy-says-no)
     
     Your code never handles a policy refusal itself.
     
13.  [The permissions report](/docs/the-permissions-report)
     
     Policy is written beside each entity, so nobody has to keep a central copy.