01 / The operating case
What changes in a real workflow?
An analyst starts an incident agent that later disables an account.
- 01Owner
- 02Agent + workload
- 03Task context
- 04Action decision
02 / Decision contract
What the executor must check
Bind task issuance to the authenticated analyst and applicable delegation; retain distinct agent and approver identities at execution.
InputPrincipal · task · action · target
DecisionGrant ancestry · policy · current state
ResultEnforce · record · verify outcome
03 / Failure and evidence
What goes wrong, and what can be proven?
Failure mode
A log collapses human request, agent choice and human approval into one actor.
Evidence to retain
Task creation, originating user, agent identity, approval and account state.
04 / Canonical scope
Why this reference stands alone
Agent-to-tool attribution owns the downstream hop; this page owns originator accountability.
Technical artifact
Three decisions, three actors
analyst U7 creates incident task T agent A proposes disable(account-42) manager U9 approves request hash H executor E applies H originator U7 is not the approver U9
Run the denial test
Have U7 create the task and then spoof U9 in agent output. Only an independently authenticated approval event can satisfy the approval policy.
Primary references