Security API/SPI: identity types, authentication records, authorization contracts, and the sealed verification-source family