Also refer to the below link to understand more on the difference between Authorizable and Principal -
Please note the difference between Authorizable and Principal:
An Authorizable is repository object that is neither associated with nor depending from a particular Session and thus independent of the login mechanisms creating Sessions.
On the other hand Principals are representations of user identities. In other words: each Principal within the set associated with the Session's Subject upon login represents an identity for that user. An the set of Principals may differ between different login mechanisms.
Consequently an one-to-many relationship exists between Authorizable and Principal (see also getPrincipal().
Source - https://developer.adobe.com/experience-manager/reference-materials/6-4/javadoc/org/apache/jackrabbit...