Who is the agent acting as?
Every agent I audited this year had the same shape of problem: it authenticated as a service account with more access than any human on the team, on behalf of a user whose identity was lost the moment the request left the browser. The question 'who is this call for' had no answer in the logs. Fixing it is mostly an OAuth problem, and the pieces exist now.
8 min readRead more →