An agent uses one shared service account for every user, and audit cannot tell who did what. What do you change?
Why D is the answer
Pass the user's identity through, and scope each call to that user
Per-user identity keeps source-system permissions in force and makes audit logs meaningful.
In detail
- Pass each user's identity through to the source system.
- Its permissions stay in force.
- Audit logs then show who did what.
- Use short-lived, per-user tokens where the source system allows.
Use case
An illustrative scenario, not a real incident.
An agent uses one service account, so the log shows the same name on every action. Passing each user's identity keeps their permissions and makes the audit useful.
See it in different ways
sequenceDiagram participant U as User participant A as Agent participant S as Source system U->>A: Request with user identity A->>S: Call scoped to that user S-->>A: Only what the user may see
sequenceDiagram participant U as User participant A as Assistant participant S as Source system U->>A: Question, with identity A->>S: Query, scoped to that user S-->>A: Only permitted documents A-->>U: Answer S->>S: Audit log names the user
flowchart TD
Q{"Which identity does the call use?"}
Q -->|"Shared account"| A0["No way to tell who acted"]
Q -->|"Each user"| A1["Permissions and audit both work"]Key point: Keep the user's identity through to the source system.
Why the other options are wrong
- A. Give the service account fewer rights across the board for all users
- Fewer shared rights still leave everyone looking the same.
- B. Rotate the shared password more often, so that exposure is limited
- Rotation does not tell you who acted.
- C. Keep a text log of what the model says it did on behalf of each user
- The model's own account is not a reliable audit record.