> ## Documentation Index
> Fetch the complete documentation index at: https://ctrlrun-docs-python-3-13-3-14.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# IdentityProvider

> Resolves the principal for one action (SPEC-v0.3 §3.1).

`ctrlrun.IdentityProvider` — class, defined at `src/ctrlrun/identity.py:70`

```python theme={null}
from ctrlrun import IdentityProvider
```

```python theme={null}
class IdentityProvider(Protocol)
    def resolve(context: IdentityContext) -> Principal | None
```

Resolves the principal for one action (SPEC-v0.3 §3.1).

Returning `None` is a **decline** — "I have nothing to say about this call" — and leaves
the v0.1 `context()` path intact, unless an `authority:` section is loaded, in which case
§3.2 refuses rather than backfilling.

Raising is a **refusal** — "I was given something and rejected it". `Control` never falls
back from one: doing so would turn a rejected token into a successful action, which is the
outcome §3 exists to prevent. Raise `IdentityError` to say so directly; anything else is
logged and re-raised as one with the original chained.

## Next

* [Python API index](/docs/reference/api/index).
* [Get started](/docs/get-started/quickstart) · [Why](/docs/why).