It is worth separating two moments: the day you design the architecture and the day you have to reconstruct what happened. A shared identity is comfortable on the first and devastating on the second.
The investigation that never happens
Picture the alert: the automation account read 4,200 customer records at 3:12 a.m. and made an external request straight after. The responder's questions are immediate — which agent, triggered by which task, on behalf of which user, reading what content before the decision.
With a shared identity, the logs answer none of them. What remains is timestamp correlation across systems that share no identifier, which is guessing with the appearance of method.
The entire difference between containing an incident in an hour or in a week is being able to name the actor.
The side effect on response
There is a second, less obvious harm. Without attribution, the only available containment is shutting everything down. And because shutting everything down carries high business cost, the decision gets postponed while someone investigates — exactly the interval in which an automated agent keeps acting in milliseconds.
Individual identity turns response into surgery: revoke that agent's credential, isolate that pod, keep everything else running.
What to put in the event to make investigation possible
- Agent identity and, separately, the delegating human identity.
- A task ID tying together every call in one execution.
- Provenance of content read before the call — the field that exposes indirect injection.
- Outcome, including denials, which are the trail of failed attempts.
The tabletop test
Take a hypothetical alert and try answering the four questions using only the logs that exist today. It takes twenty minutes and produces the exact list of what is missing. It is the cheapest agent-security exercise I know, and almost nobody runs it before the real incident.
