> ## Documentation Index
> Fetch the complete documentation index at: https://ctrlrun.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# IdentityProvider

> Resolves the principal for one action (SPEC-v0.3 §3.1).

`ctrlrun.IdentityProvider` — class, defined at `src/ctrlrun/identity.py:70`

```python theme={null}
from ctrlrun import IdentityProvider
```

```python theme={null}
class IdentityProvider(Protocol)
    def resolve(context: IdentityContext) -> Principal | None
```

Resolves the principal for one action (SPEC-v0.3 §3.1).

Returning `None` is a **decline** — "I have nothing to say about this call" — and leaves
the v0.1 `context()` path intact, unless an `authority:` section is loaded, in which case
§3.2 refuses rather than backfilling.

Raising is a **refusal** — "I was given something and rejected it". `Control` never falls
back from one: doing so would turn a rejected token into a successful action, which is the
outcome §3 exists to prevent. Raise `IdentityError` to say so directly; anything else is
logged and re-raised as one with the original chained.

## Next

* [Python API index](/reference/api/index).
* [Get started](/get-started/quickstart) · [Why](/why).


## Related topics

- [context](/reference/api/context.md)
- [Principal](/reference/api/Principal.md)
- [Roadmap](/ROADMAP.md)
- [Architecture](/ARCHITECTURE.md)
- [Python API](/reference/api/index.md)