Separate three identities
Audit records should distinguish the human, the software agent and the execution environment. The human supplies intent and business accountability, the agent selects steps, and the runtime provides compute and tool access. Collapsing all three into one technical user makes it impossible to tell a requested action from an autonomous choice or a compromised host.
Give every agent a stable identity, version and owner. Bind each session to its initiator, task purpose and authority expiry.
Delegate a bounded capability
Do not copy a user's broad token. Issue a narrow capability: read a named folder, prepare a draft request or execute an operation within a defined range. Evaluate resource, action, time, context and whether onward delegation is permitted.
When an agent calls a sub-agent, the derived authority must never exceed the original grant. Restrictions and expiry travel with it, while every link remains visible to audit.
Match approval to risk
Low-risk reads may run automatically. A reversible record change can receive post-action review, while payment, deletion, publication or access grants require explicit human approval. The approval screen should show the object, action, consequence and request origin rather than a generic continue button.
Apply volume, value, recipient and time limits as well. Correct authorization should not allow an agent to repeat a mistaken action indefinitely.
Preserve a provable chain
The audit trail connects initiator, agent, model and configuration, input, granted authority, tool calls and outcome. Remove secrets and unnecessary personal data, but retain the policy decision and human approval in tamper-resistant storage.
Revocation must stop active jobs, invalidate derived credentials and place integrations into a safe mode. This turns an agent from a smart service account into a governed participant in the process.