Security principal
= Security principal
A <security principal> is an identity to which an <access control> system can attribute requests or permissions. It can represent a user, an <access-control group>, a service or a machine. <Authentication> establishes a claimed identity; <authorization> decides which operations that identity may perform.<Security Principals in the Microsoft documentation>[opening definition, accounts, security identifiers and access control]{ref}
For example, an analysis service can read a <file> using its own service identity even when a human user initiated the request. The relevant <security principal> for the <file> access is the identity carried into that access check, not automatically the human at the keyboard. Explicit identities prevent accidental confusion between who requested an action and whose authority executes it.