Add RequestIdentityMode to PDP requests

api/proto/teleport/decision/v1alpha1/request_metadata.proto

@@ -34,6 +34,10 @@ message RequestMetadata {
   // via feature assertions so that PEPs can correctly reject decisions that
   // they cannot enforce.
   string pep_version_hint = 2;
+
+  // IdentityMode dictates how the request identity (tls_identity or
+  // ssh_identity) is interpreted by the server.
+  RequestIdentityMode identity_mode = 3;
 }
 
 // DecisionFeature represents supported PDP (Policy Decision Point) features.
@@ -42,3 +46,22 @@ enum DecisionFeature {
   // DecisionFeature. Asserting this feature has no effect.
   DECISION_FEATURE_UNSPECIFIED = 0;
 }
+
+// RequestIdentityMode dictates how the request identity (either
+// tls_identity or ssh_identity) is interpreted by the server.
+enum RequestIdentityMode {
+  // Unspecified identity mode.
+  // Defaults to _EXPLICIT unless stated otherwise by the RPC.
+  REQUEST_IDENTITY_MODE_UNSPECIFIED = 0;
+  // The request identity is interpreted as-is, without any changes.
+  REQUEST_IDENTITY_MODE_EXPLICIT = 1;
+  // The request identity is interpreted as a partial definition, meaning the
+  // identity will be augmented with storage queries. For example: the username
+  // is supplied by the caller, but roles are queried from storage.
+  // Useful for querying the access capabilities of a third-party whose identity
+  // isn't fully known.
+  REQUEST_IDENTITY_MODE_PARTIAL = 2;
+  // The caller identity is used. The request identity is completely ignored.
+  // Useful for querying the access capabilities of the current user.
+  REQUEST_IDENTITY_MODE_CALLER_IDENTITY = 3;
+}