> ## Documentation Index
> Fetch the complete documentation index at: https://ctrlrun.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Principal

> Who is acting: an agent, optionally on behalf of a human.

`ctrlrun.Principal` — class, defined at `src/ctrlrun/action.py:139`

```python theme={null}
from ctrlrun import Principal
```

```python theme={null}
class Principal
    def __init__(agent: str, user: str | None = None, claims: Mapping[str, ClaimValue] = (lambda: NO_CLAIMS)(), issuer: str | None = None, expires_at: datetime | None = None)
```

Who is acting: an agent, optionally on behalf of a human.

`claims`, `issuer` and `expires_at` are what an `IdentityProvider` verified (SPEC-v0.3 §2.1).
None of the three is part of the canonical form (§2.2): an approval binds to an action hash,
and a hash that moved when a token rotated would invalidate it for a reason no human could
see and no agent could fix.

## Next

* [Python API index](/reference/api/index).
* [Get started](/get-started/quickstart) · [Why](/why).


## Related topics

- [context](/reference/api/context.md)
- [The gateway in five minutes](/mcp/gateway-in-5-minutes.md)
- [Put the gateway in front of MCP](/guides/gateway-in-front-of-mcp.md)
- [Errors](/reference/errors.md)
- [IdentityError](/reference/api/IdentityError.md)