You wire an agent into the refund queue on a Friday afternoon. It needs a token, and the token you have is your own, so you paste that one in. It works, and you forget about it. Three weeks later a compliance review pulls the history on a refund nobody remembers approving, and the entry carries a name: yours, at 3:14 in the morning. You were asleep. The history is not broken. As far as the payments system was ever told, the person who issued that refund was you, and nothing in the record is capable of saying otherwise.

The referee writes numbers, never faces

Watch a referee work a Sunday game. He does not know these players and will never see most of them again. He does not write faces on the scoresheet; he writes numbers. Number 8 fouls, number 8 is cautioned, and a week later a disciplinary panel can read that line and know exactly who owes an explanation. The whole system rests on one quiet condition: each number belongs to one person. Let two players wear 8 and the sheet stops meaning anything. Let a player borrow a teammate’s shirt and the caution lands on someone who was on the bench.

An agent needs a number of its own, and there are two honest ways to give it one. In the on-behalf-of model, the agent carries the identity of the person who asked: the harness works out who is speaking in the channel, maps that person to per-tool credentials, and keeps memory and data separated per user, so an onboarding assistant reading Notion and HR under Alice’s permissions cannot surface anything of Bob’s. In the fixed-credential model, the agent holds an account of its own with a deliberately narrow scope and answers everyone with the same permissions, which is why an email agent working from the agent account’s calendar asks the owner before it sends invitations. Whoever typed the request is not necessarily the person with the authority.

The shirt gets you known, not allowed

A number tells the referee who did something. It does not tell him that the substitute may come on right now, and the substitute knows it: he waits at the touchline until the play stops and the assistant raises the board. Identity and permission are separate questions, asked at separate moments.

That second question belongs to a decision plane the agents share. An enforcement point in front of the tool sends the action, the resource, the user and the surrounding attributes to a protected decision point, which weighs tenant and residency, data classification, entitlement and risk, then answers allow, deny, require approval, or mask. A finance agent proposes a purchase order of 70,000. Its access to the ERP is real and its identity is beyond doubt, and the answer is still require approval, because the amount crosses a threshold; the tool fires only once a manager has signed. OAuth tells you an interface is reachable. It never tells you the business permits this action, at this size, today. Keep that logic in one plane rather than in every agent’s prompt, leave no side route to the tool that skips the enforcement point, and put the human where the risk actually sits, as an event the system waits on.

Nobody invents a new scoresheet each week

The referee’s form is not his invention. Every competition uses the same one, which is why the panel can read it. Agent identity is heading the same way: treat the agent as a workload, give it a verifiable identifier and credentials provisioned for its trust domain, then reuse what already exists. OAuth carries the delegation from a person. Token exchange narrows the result to one audience and one scope. A proof token binds it to the holder, so it cannot simply be lifted and worn. A procurement agent takes a user’s delegation, exchanges it for a token good only against the ERP and only for creating an order, proves it holds the matching key, and gets nowhere if it presents that token to an outside interface it was never granted.

The last piece is when the record gets written. A deterministic enforcement point checks the transfer amount and the payee against declared policy before the network call, refuses, and stores a signed receipt naming the rule that refused it. A denial logged after the fact is a story about something irreversible. Written first and signed, it is evidence.

An agent without a name of its own does not go unrecorded. It gets recorded as you.