> For the complete documentation index, see [llms.txt](https://docs.forestall.io/forestall/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/forestall/unified-identities/gcp-identities/principals.md).

# Principals

Open **Unified Identities › Non Human Identities**, filter **Providers** to **GCP Identities › Principal**, then select a row to open its details. A Principal represents an identity (or set of identities) that can be granted IAM roles, such as a federated user, service account, or a principal set matched via a workforce/workload identity pool.

<figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-9073af455a6463ebb96b9cff7b60f77a07e420a8%2FGCPPrincipalListPage.png?alt=media" alt=""><figcaption><p>Principals</p></figcaption></figure>

### Principals Details

Opening a principal shows the **`Details`** tab. The card title can carry a `Tier 0`/`Tier 2` badge.

{% hint style="info" %}
You can analyze the object in the [Graph](/forestall/visualize/visualize.md) by clicking the **Graph »** button next to the `Information` title.
{% endhint %}

<figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-2bd53faba9dba94e1f105c672fead8bd439fc583%2Fgcp-principal-detail-page.png?alt=media" alt=""><figcaption><p>GCP Principal Details</p></figcaption></figure>

The Details tab contains attributes about the Principal. The page also includes an **Issues** panel that lists any security findings related to the principal, along with a Risk score and Exposure Point.

### Information

| Attribute      | Description                                                                                                                                     |
| -------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- |
| Parent Pool    | The workforce or workload identity pool this principal belongs to (e.g., `workforce-pool-test-2`).                                              |
| Principal Type | The classification of the principal (e.g., `principalSet`).                                                                                     |
| Subject        | The fully-qualified subject identifier of the principal (e.g., `//iam.googleapis.com/locations/global/workforcePools/workforce-pool-test-2/*`). |

#### **Issues**

Lists security findings associated with the principal (e.g., *Role Assigned to Entire Federated Identity Pool*), each tagged with relevant categories such as Least Privilege or Privilege Escalation, and a severity rating (e.g., High).