Optional
why verification failed (absent on success).
the { scopes } Principal — the SAME shape principalFromSession returns, so enforceAccess works identically.
{ scopes }
why verification failed (absent on success).