Please address the comments from this code review:

## Overall Comments
- In `InternalRole.GetPermissions`, you rely on `storage.Access_value[access]` returning the zero value for unknown access strings; consider doing an explicit map lookup and defaulting to `Access_NO_ACCESS` for clarity and to avoid surprises if the enum map ever changes.
- In `InternalRole.GetAccessScope`, a `ClusterScope` with `ClusterFullAccess` set but an empty `ClusterName` will produce an empty cluster entry in `IncludedClusters`; consider skipping or validating such entries to avoid constructing malformed scopes.

Please address the comments from this code review:

## Individual Comments

### Comment 1
<location path="pkg/grpc/authn/tokenbased/extractor_test.go" line_range="103-101" />
<code_context>
+	authProvider authproviders.Provider
+}
+
+func TestExtractorIdentityForRequest(t *testing.T) {
+
+}
+
+func TestExtractorWithRoleNames(t *testing.T) {
</code_context>
<issue_to_address>
**issue (testing):** Implement or remove the empty TestExtractorIdentityForRequest test

This test is currently empty and doesn’t exercise `extractor.IdentityForRequest`. To avoid misleading coverage, either remove it or add meaningful cases (e.g., no token, malformed token, valid internal-role token, valid external-user token, multiple auth providers). Having at least one happy-path and key error-path case will ensure `IdentityForRequest` is covered at an integration level.
</issue_to_address>

### Comment 2
<location path="pkg/grpc/authn/tokenbased/extractor_test.go" line_range="123-129" />
<code_context>
+	for name, tc := range map[string]struct {
</code_context>
<issue_to_address>
**suggestion (testing):** Add a test case for external-user tokens with more than one source

In `TestExtractorWithExternalUser`, we only test the error for **no sources**, but not for **multiple sources**. Please add a table entry where `Sources` has length > 1 and assert we get the same "external user tokens must originate from exactly one source" error, so refactors can’t accidentally allow multi-source external-user tokens.

```suggestion
	for name, tc := range map[string]struct {
		testToken            *tokens.TokenInfo
		roleNames            []string
		setupMocks           func(*testExtractor)
		expectedErrorMessage string
	}{
		"Error: external user token with multiple sources": {
			testToken: &tokens.TokenInfo{
				Claims: buildRoleNamesClaims(
					testName,
					testSubject,
					testID,
					[]string{roleName1},
					testExpiresAt,
				),
				// Multiple sources should trigger:
				// "external user tokens must originate from exactly one source"
				Sources: []tokens.Source{
					mockSource,
					mockSource,
				},
			},
			// No special mocks required; the extractor should fail on validation
			setupMocks: func(te *testExtractor) {},
			expectedErrorMessage: "external user tokens must originate from exactly one source",
		},
		"Error: Role store GetAndResolveRole fails": {
```
</issue_to_address>