The host resolves identity from its own session/JWT and returns the caller's scope. Throwing or returning null denies the request; the server never fails open.
The host resolves identity from its own session/JWT and returns the caller's scope. Throwing or returning null denies the request; the server never fails open.