The cluster can still show which identity called the Kubernetes API, but it cannot preserve the user to agent link for work done elsewhere, such as in ticketing systems, code hosts or databases. That breaks accountability for the person who authorized the task. Without a separate delegation record, investigators cannot tie the action back to the initiating user with confidence.
What breaks when the delegation record is missing?
When an AI agent acts for a user, the delegation record is the evidence that links the user’s intent to the agent’s execution. Without it, you may still see the agent or service principal that touched a system, but you lose the authoritative chain that says the user approved that action. The result is a partial audit trail, not full accountability.
That distinction matters because many downstream systems record only the actor that connected to them, not the human who initiated the task. If the delegation context is absent, the action can look legitimate at the system boundary while remaining impossible to attribute with confidence across tools, tickets, code hosts, or databases.
Why this is an accountability problem, not just a logging problem
A missing delegation record changes the security meaning of the event. The cluster can tell you who called the Kubernetes API, but it cannot prove that the call was performed under a valid user-to-agent authorization path. That gap weakens non-repudiation, makes incident review slower, and can leave teams arguing over whether the agent acted within scope or merely had access.
This is why on-behalf-of flows are more than a convenience pattern. A delegation record captures the token exchange relationship defined in RFC 8693, which is what lets investigators reconstruct who initiated the work and under what authority. If the record is absent, the trace collapses to a single runtime identity and the human authorizing party disappears from the evidence chain.
In practice, that means the event may remain technically observable but operationally unattributable. Teams can confirm that an agent did something, yet still be unable to answer the question that matters most during review: who asked it to do it?
How practitioners should preserve the user-to-agent link
The right control objective is to preserve three things together: the authenticated user, the delegated scope, and the action record. If any one of those is missing, the resulting evidence is incomplete for accountability purposes. That is especially important when the agent’s work continues in systems that do not understand Kubernetes context and only log their own local caller.
- Record the initiating user, the agent identity, the delegated scope, and the task or purpose identifier.
- Carry that identifier into ticketing, source control, workflow, and database actions so the audit trail stays coherent outside the cluster.
- Treat missing delegation metadata as an exception condition, not a harmless logging omission.
The strongest practical pattern is to make delegation explicit at the time authority is granted, then propagate that record alongside the agent’s execution. NHIMG’s Agentic AI Identity Guide covers the identity lifecycle, delegation and retirement model for agents, while the AI Agent Authorisation Guide focuses on task-scoped and just-in-time authority. Together they point to the same operating principle: the agent should never be the only thing you can prove.
Risk and Threat Considerations
Missing delegation records create a real trust gap because they allow legitimate-looking actions to outlive their proof of authorization. That weakens investigations, complicates access reviews, and can let excessive or unintended agent activity blend into ordinary system noise.
Failure mechanism: the runtime system records the agent’s local identity, but the delegation evidence that ties the action back to the initiating user is lost, never created, or not propagated to downstream systems.
Impact: investigators cannot reliably attribute the action, containment teams may rotate or revoke the wrong access, and governance teams lose the ability to prove that the user authorized the task that the agent executed.
Where agents can touch databases, code hosts, or support systems, the missing record also becomes an abuse surface. A malicious or overreaching action may be harder to distinguish from valid delegated work, especially if the agent has broad standing access and the environment lacks an immutable task trail.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-9 — Service Identification and Authentication | Agent-to-system delegation and on-behalf-of execution depend on service-level identity proof. |
| AU-2 — Event Logging | Missing delegation records create audit gaps across systems and workflows. | |
| AC-6 — Least Privilege | Delegated agents need constrained authority so missing linkage does not amplify impact. | |
| Recommendation — Enforce service authentication and preserve delegation evidence for every agent action. Log the initiating user, agent identity, delegated scope, and correlation ID together. Limit agent permissions to the minimum task scope and time window needed. | ||
| NIST Zero Trust (SP 800-207) | Zero Trust Architecture | Continuous verification and explicit trust boundaries fit delegated agent execution. |
| Recommendation — Verify the principal, request, and policy before allowing delegated agent actions. | ||
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | A missing delegation record weakens control over agent authority and attribution. |
| Recommendation — Bind each agent action to a verified user delegation and scoped privilege. | ||
Practitioner Guidance
What to verify: confirm that every delegated action has a durable record showing the initiating user, the agent identity, the delegated scope, and a correlation ID that survives handoff into external systems. If those fields are not recoverable after the fact, the control is not strong enough for audit or incident response.
Decision rule: if the agent can take an action that would be sensitive when performed by a human, require explicit delegation evidence before execution and treat any missing linkage as a control failure, not an acceptable default.
Practitioner takeaway: the goal is not merely to know that an agent acted, it is to preserve a defensible chain of authorization from the user to the action wherever the work continues.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 30, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
