How to configure Inbound message processing interception with principal criteria

[Cantor, Scott]

You can't use an inbound intercept for this, that runs before authentication happens.

I would also add there is no reason for a custom flow here, the context-check intercept can do this and is literally designed to.

There's also no reason I can think of to care whether there's a session created or not, at least not enough to turn a trivial out of the box requirement into something exotic.

-- Scott