OptionalonOptionalrolesFree-form role names — typically a copy of Sanity's user.roles[].name
for the token behind the call, as the workflow resource's host reports
them (project roles for dataset resources). The engine treats these as
opaque strings, matched by literal membership: Action.roles and
assignees roles OR-match against this list. There is no actor-side
wildcard — a "*" here is just a literal string and matches nothing on
its own.
To let one role satisfy a gate it doesn't literally name — e.g. an
administrator satisfying a narrower gate, or one deployment's role
standing in for another's — declare the definition's roleAliases
"can be fulfilled by" map; it widens the REQUIRED side, never the
actor's roles.
Who is acting — advisory provenance, not an authenticated principal. The engine always resolves it from the client's token; there is no way to pass or synthesize one. The stamp is still advisory: nothing re-verifies it at read time, and only the lake's own token identity is authenticated — hard enforcement lives there.
idis the account-global user id — the one identity namespace that is stable across projects and org-level resources. The engine takes it from the first route that can answer for the token: an id either host's/users/mealready carries in account-global form (the id itself, or the one embedded in ane-principal), and otherwise the project's own user directory (sanityUserId) — the route a session scoped to a single project depends on, since no global record exists for it. Robot tokens carry a single universal id, so for themidequals what every host returns. Instances written before ids were namespace-classified carry the workflow resource's local principal id inidinstead; readers interpret those through the prefix classifier incore/identity.tswith the document's home resource as the implied scope.