constructive-principals
Constructive Principals
Principals are scoped sub-identities of a human user. They are how you give an agent or an API key its own identity that acts on a human's behalf while carrying only a subset of that human's capabilities. A principal never exceeds its owner's access, and everything it does still meters and audits back to the owning human.
This skill covers principals from the application layer — how to create them, issue and revoke their API keys, and scope them to specific orgs, all through the generated SDK ORM. It intentionally does not cover the SQL/trigger internals (see the constructive-db-principals skill in constructive-db for that).
The App access and Organizations feature packs provide host-facing principal and API-key management views when the tenant exposes compatible operations. Use constructive-blocks for those UI surfaces; use this skill for the identity and authority model.
When to Apply
Use this skill when:
- Issuing an API key for a CI pipeline, script, webhook, or integration
- Giving an AI agent its own credential and identity
- Creating a read-only credential that physically cannot write
- Scoping a credential to specific orgs (or leaving it unrestricted)
- Revoking an API key or deleting a principal
- Understanding why a credential can see less than its owning human