You lose evidence of which agent performed the work, so access reviews cannot separate delegated machine behaviour from the person who started the task. That creates weak accountability, poor forensics, and misleading compliance evidence.
Why the audit trail becomes unreliable when only the human account is recorded
When an agent acts under a human user’s identity, the log tells you who initiated the session, not which autonomous actor carried out each step. That collapses two different accountability layers into one record. The practical result is that audit evidence can no longer distinguish delegated action from direct human action, which weakens review quality and post-incident reconstruction.
This matters most when the agent can query systems, move data, or trigger external actions on behalf of the user. In those cases, the human account becomes an umbrella for multiple actions with different intent, timing, and risk. Without agent-level attribution, a reviewer cannot tell whether a change was a deliberate user decision, an automated follow-on, or an unexpected agent behaviour.
What you lose in access review, forensics, and compliance evidence
Access reviews depend on knowing which subject actually exercised privilege. If an agent’s activity is merged into the user’s history, reviewers may incorrectly certify access because the human appears to have used the capability legitimately, even when the real question is whether the agent should have had that path at all. Regulatory and audit perspectives on non-human identities are useful here because they frame why audit trails, governance, and access review must reflect the actual actor, not just the sponsoring person.
Forensics also degrades. If the same human account launches several agent tasks, the incident timeline becomes ambiguous: you can often prove that the user was involved, but not isolate which agent action caused the change, exfiltration, or policy violation. That makes root-cause analysis slower and weakens evidence preservation because the investigator has to infer attribution from indirect clues instead of direct logs.
Compliance evidence suffers for the same reason. A control that asks for accountability, recertification, or traceability is not well served by records that hide delegated machine behaviour inside human activity. The report may look complete, but it no longer proves that the right actor was governed under the right access path.
How to preserve accountability when humans and agents share a session
The fix is not to stop delegation, but to log it explicitly. Agent actions need their own identity, session markers, or transaction-level attribution so that the record captures both the sponsoring human and the acting agent. AI Agent Observability, Audit and Incident Response Guide is relevant because it focuses on agent logging, attribution, and the signals needed to investigate bad behaviour.
When an agent is acting on behalf of a user, the log should preserve a chain of responsibility rather than a single flat username. That means correlating the user intent, the agent identity, the policy decision, and the resulting action. Where the task is sensitive, the best evidence is a tuple, not a name: initiator, delegated actor, scope, time, and outcome.
In higher-risk environments, treat shared human-agent logging as a design smell unless you can reconstruct who did what without guesswork. If the audit trail cannot support action-level attribution, it cannot reliably support access review, incident response, or exception handling.
Risk and Threat Considerations
Auditing only through the human account creates a hidden control gap because it lets autonomous activity inherit trust from a person who may not have reviewed each step. That can mask overreach, conceal suspicious automation, and make malicious or unintended agent actions look like ordinary user behaviour.
Failure mechanism: The system collapses delegation, execution, and ownership into one identity record, so the defender loses the ability to separate approved human intent from independent agent action.
Impact: Misattribution leads to weaker recertification, slower incident response, poor evidence quality, and a larger chance that excessive or abusive agent behaviour remains undetected until damage is already done.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | Agent action audited as human activity hides delegated privilege use. |
| Recommendation — Separate agent execution logs from human session logs and enforce per-action authorization. | ||
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | Shared human-only audit trails obscure whether agent access still exists after task completion. |
| Recommendation — Record agent ownership and revoke delegated access when the task ends. | ||
| NIST SP 800-53 Rev 5 | AU-2 — Event Logging | Audit records must capture the acting subject to support accountability and forensics. |
| AU-10 — Non-repudiation | Attribution fails when agent behaviour is merged into the human account record. | |
| IA-9 — Identification and Authentication (Non-Organizational Users) | Agents acting as separate entities need distinct identity and authentication treatment. | |
| Recommendation — Log delegated agent actions with enough detail to reconstruct who acted and under what authority. Preserve evidence that distinguishes initiator, delegated actor, and action outcome. Authenticate the agent separately so logs can bind actions to the correct actor. | ||
Practitioner Guidance
What to verify: Confirm that your logs preserve both the initiating user and the acting agent for every delegated operation that can modify data, invoke tools, or cross a trust boundary. If you cannot reconstruct that chain from the record alone, the audit model is not strong enough for sensitive automation.
Common mistake: Teams often assume a user session log is sufficient because the person approved the task. That shortcut breaks down as soon as the agent can fan out, retry, or take conditional actions that the human did not review individually.
What good looks like: A reviewer can answer three separate questions from the audit trail: who started the task, which agent executed each step, and what authority bounded that step.
Practitioner takeaway: If delegation is real, attribution must be real too, otherwise the audit trail measures human initiation but not machine execution.