The scope identity a session is keyed on for principal — the one value SessionManager stamps as
the session conversation's ExternalID and AuthorizeSessionAccess compares against it.
The token's resource scope (MagicLinkScope.ResourceID) when it carries one. A widget guest's
resource scope IS its mj_sid; an anonymous magic-link invite with a ResourceID (e.g. a Caliber
Invite Scope, one per subject) shares that scope across its redemptions by design, and the
{{ScopeResourceID}} RLS filters key on the same value, so the visitor can read its own rows.
Otherwise, for an anonymous principal, the per-token mj_sid (AnonymousVisitorID), which tells two
redemptions of an unscoped multi-use invite apart.
Otherwise undefined (a named user without a resource scope).
The scope identity a session is keyed on for
principal— the one valueSessionManagerstamps as the session conversation'sExternalIDand AuthorizeSessionAccess compares against it.MagicLinkScope.ResourceID) when it carries one. A widget guest's resource scope IS itsmj_sid; an anonymous magic-link invite with aResourceID(e.g. a Caliber Invite Scope, one per subject) shares that scope across its redemptions by design, and the{{ScopeResourceID}}RLS filters key on the same value, so the visitor can read its own rows.mj_sid(AnonymousVisitorID), which tells two redemptions of an unscoped multi-use invite apart.undefined(a named user without a resource scope).