Derive OIDC and SAML browser-session principals from provider-scoped subjects instead of mutable username or email claims.
Preserve compatibility by migrating legacy username/email RBAC assignments to the stable SSO principal when no authoritative group mapping is present, and pin the invariant in API/security contracts.
rcourtman