Access Principal
A security subject an access authority recognizes: an individual, a group or a service.
An Access Principal is the subject an authority, such as an identity provider, issues permissions to. It is not the person, the membership or the tool account. The table had no rows on 2026-10-28.
Rules and relationships
Create one principal per Authority Identifier. Link a Tool Account only after the authority confirms the match; linking grants nothing. Group Member and Member Of are a self-referencing pair: set members on the group row (Kind = group). A tool’s own member list is not an authority unless the group designated it one.
Fields
| Field | Storage | Current configuration |
|---|---|---|
| Authority Identifier | Text | Id issued by the access authority; one principal per id |
| Kind | Single select | individual, group, service |
| Authority | Text | Trusted service that recognizes the principal |
| Grants | Linked records | Access Grant; Multiple-record picker |
| Tool Account | Linked records | Tool Account; Multiple-record picker |
| Group Member | Linked records | Access Principal; Multiple-record picker |
| Member Of | Linked records | Access Principal; Multiple-record picker |
| Tags | Linked records | Tags (mirror); Multiple-record picker |
Example
Authority = Google Workspace; Authority Identifier = 8f3a1c2e-user; Kind = individual; Tool Account = ana.costa. A group principal finance-team lists it in Group Member.