How Sake finds the person behind a request. The host implements it:

defmodule MyAppWeb.MCPSubject do
  @behaviour Sake.Auth.Subject
  def from_conn(conn), do: with(%{user: user} <- conn.assigns[:current_scope], do: {:ok, user}, else: (_ -> :error))
  def id(user), do: user.id
  def fetch(id), do: MyApp.Accounts.fetch_user(id)
  def display(user), do: user.email
end

Sake stores only the string ID.

The optional authorize_resource?/2 decides whether this person may authorize a client for an endpoint URL; without it, every signed-in person may. A multi-tenant host uses it to refuse a token for a tenant the person does not belong to (see the tenants guide).