AI identity

When an agent does something, the record has to show whose authority it used.

Otherwise the audit log says a service account did it, which tells you nothing about who asked, on what basis, or whether they were entitled to. Delegated authority that cannot be traced back to a person is authority nobody is accountable for. This is an old problem wearing new clothes, and it gets harder as agents call other agents.