[security-dev] APIs for principal/role propagation