ctrlrun.IdentityProvider — class, defined at src/ctrlrun/identity.py:70
None is a decline — “I have nothing to say about this call” — and leaves
the v0.1 context() path intact, unless an authority: section is loaded, in which case
§3.2 refuses rather than backfilling.
Raising is a refusal — “I was given something and rejected it”. Control never falls
back from one: doing so would turn a rejected token into a successful action, which is the
outcome §3 exists to prevent. Raise IdentityError to say so directly; anything else is
logged and re-raised as one with the original chained.