OptionalrolesOptional roles attached to the active identity.
Runner does not interpret these automatically unless a task identity gate
or middleware.task.identityChecker explicitly requests them. If your app
models inherited roles, expand the effective role set before binding the
identity so the gate sees the right access surface.
OptionaltenantStable tenant identifier used to partition tenant-aware framework state when present.
OptionaluserStable authenticated user identifier used by user-aware identity scopes when present.
Minimal identity payload Runner understands for identity-aware framework behavior.
tenantIdanduserIdare both optional at the ambient context level so apps can establish identity gradually across request/auth boundaries. Middleware that opts into identity partitioning validates the fields it actually needs at use time.