# AGT-004: Attribute every connector and tool call alert to a person


- Area: Agent & MCP Governance

- Verification: Live test
- OWASP adoption tier: AT3, AT4, AT6

- URL: /r/AGT-004

**Acceptance criteria:** Answer which server and tool were called, by whom, using which identity, every time an alert or intervention fires.

**Why it matters:** Without attribution, an agent action cannot be investigated or tied to accountability.

**How to verify:** Every pilot tool call alert shows the tool used, the surface, the user identity, and the result.

**OWASP adoption context:** The listed connected-agent contexts need an identity chain from the employee to the server and tool call, including the delegated identity actually used.

**Mappings:**
- SOC 2: CC2.1, CC7.2 — Linking the person, execution identity, server, tool, scope and result supplies usable information for correlating calls and reviewing identity use. It can reveal gaps between human and delegated identities; attribution alone does not authenticate the caller, manage the identity lifecycle or authorize the operation.
- ISO 42001: A.6.2.8; ISO 27001: A.8.15 — The person-to-identity-to-tool chain supplies attribution needed for AI event records and an audit trail. Answering those questions does not by itself require persistent protected logs, and the chain must preserve the distinction between the person and any service or delegated identity.
ISO/IEC 27001: Human attribution must not expose credential values.
- OWASP ASI: ASI03 — Visible identity and scope relationships help investigate inherited-identity abuse, excessive delegation and confused-deputy behavior. Attribution exposes how authority was used; it does not itself stop an unauthorized call.
- NIST CSF 2.0: DE.AE-03 — Joining the person, execution identity, server, tool, scope and result supports event correlation. Attribution does not authenticate the caller, manage identity lifecycles or authorize the operation.