What is an Agent Identity?

Every meaningful action an agent takes needs to answer "acting as whom, with what authority," and identity is the object that answers it. This is more layered than a simple username: an agent might have its own machine identity for internal operations, while also carrying a delegated identity when it's acting on a specific user's behalf (sending an email "from" that user, for instance). Conflating the two is a common source of security bugs — an agent's own service identity should never silently substitute for a user's verified identity when scoping what data it can touch. Identity underpins both authentication (proving the identity is real) and authorization (deciding what that identity can do), and it needs to be stable enough that an audit trail months later can say definitively which identity performed which action — not just "an agent did it," but which agent, on whose behalf, in which tenant.