feat: version automation principal subjects

tests/test_automation_contract.py

@@ -25,6 +25,27 @@ class _Provider:
 
 
 class AutomationContractTests(unittest.TestCase):
+    def test_principal_request_has_explicit_subject_contracts(self) -> None:
+        service = AutomationPrincipalRequest.service_account(
+            tenant_id="tenant-1",
+            service_account_id="service-1",
+            authorization_ref="trigger:1",
+            grant_scopes=("dataflow:pipeline:run",),
+        )
+
+        self.assertEqual("service_account", service.subject_kind)
+        self.assertEqual("service-1", service.service_account_id)
+        self.assertIsNone(service.account_id)
+        with self.assertRaisesRegex(
+            ValueError,
+            "Delegated-user automation",
+        ):
+            AutomationPrincipalRequest(
+                tenant_id="tenant-1",
+                authorization_ref="trigger:1",
+                grant_scopes=("dataflow:pipeline:run",),
+            )
+
     def test_invocation_records_stable_trigger_provenance(self) -> None:
         invocation = AutomationInvocation(
             kind="event",