impersonate should work on only a principalId so clients don't need to fetch the full principal