Acceptance criteria
Answer which server and tool were called, by whom, using which identity, every time an alert or intervention fires.
Why it matters
Without attribution, an agent action cannot be investigated or tied to accountability.
How to verify
Every pilot tool call alert shows the tool used, the surface, the user identity, and the result.
OWASP adoption context
The listed connected-agent contexts need an identity chain from the employee to the server and tool call, including the delegated identity actually used.
Framework mappings
Linking the person, execution identity, server, tool, scope and result supplies usable information for correlating calls and reviewing identity use. It can reveal gaps between human and delegated identities; attribution alone does not authenticate the caller, manage the identity lifecycle or authorize the operation.
The person-to-identity-to-tool chain supplies attribution needed for AI event records and an audit trail. Answering those questions does not by itself require persistent protected logs, and the chain must preserve the distinction between the person and any service or delegated identity. ISO/IEC 27001: Human attribution must not expose credential values.
Visible identity and scope relationships help investigate inherited-identity abuse, excessive delegation and confused-deputy behavior. Attribution exposes how authority was used; it does not itself stop an unauthorized call.
Joining the person, execution identity, server, tool, scope and result supports event correlation. Attribution does not authenticate the caller, manage identity lifecycles or authorize the operation.