A copilot books a supplier, an agent approves a refund, a chat tool exports a customer table. The log says the AI did it. That tells you which tool ran. It does not tell you the thing accountability actually needs: who the action counted against. Someone authorised that refund. Someone owns the data that left. The agent is the instrument. The principal is the party the action attaches to, and the principal is the part most systems forget to record.
Give every agent a strong identity and you have solved a real problem: you can tell one agent from another, rotate its keys, revoke it. What you have not solved is attribution. "Service account refund-bot issued a $4,000 credit" is a fact about a process. It leaves open the question every auditor, regulator, and incident responder asks first: on whose authority? Nobody has yet managed to hold a service account responsible for anything.
That question has a specific answer at the moment the action happens. A support agent triggered the refund flow. A named employee kicked off the export. Accountability attaches to that human or that organisation, not to the automation they set in motion. When the record only names the tool, you reconstruct the principal afterward from shift rosters, session logs, and memory. That reconstruction is where disputes are won and lost, and it is the weakest evidence you can bring.
Athena treats the principal as a field, captured at action time and written into the sealed record alongside the agent's own identity. Three things are recorded together, not stitched together later:
Recording these as one unit is the point. The on-behalf-of is not a comment appended after the fact or a value looked up when someone finally asks. It is bound into the same sealed evidence as everything else about the action, so the "who acted for whom" travels with the "what happened" and cannot be quietly separated from it.
The binding is deterministic. The record is serialised to RFC 8785 canonical form and signed with ML-DSA-65 (FIPS 204). Anyone holding the public key can recompute the canonical bytes and verify the signature offline, with no call back to Athena and no trust in us. If a byte of the on-behalf-of field changes after sealing, the signature fails. That makes the field tamper-evident: not impossible to alter, but impossible to alter without the check catching it. Each record verifies on its own. This is a single-record proof, not a transparency log.
There is a line here we will not cross, because the value of the field depends on it. Athena records the on-behalf-of that was asserted at action time and seals it. That is a different claim from proving the delegation was authentic.
Whether the asserted principal genuinely authorised the agent, and had the authority to, depends on your identity provider and your controls: how the agent obtained its mandate, how the human authenticated, how tightly your auth binds a session to a person. Athena does not manufacture that strength. A weak assertion sealed carefully is still a weak assertion, now recorded honestly instead of lost.
Athena captures the principal at the moment of the action, from whatever your identity layer supplies, and binds it into evidence that cannot be edited after the fact without detection. Strong delegation upstream plus this recording gives you an attribution chain you can defend. It is candidate evidence for that chain. We do not issue legal opinions, and we do not grant certification.
The moment of the action is the only time the principal is unambiguous. The session is live, the mandate is in hand, the caller is known. Every second after that, the answer degrades. Sessions close, context is dropped, two runs interleave and their principals blur. Reconstruction becomes inference, and inference is contestable precisely when you least want it to be, during an incident review or a regulator's request.
Sealing the on-behalf-of at action time also removes a specific failure: silent back-editing. If the principal is a field you look up later, someone can change what "later" returns. If it is bound into a signed record, changing it breaks the signature. The difference matters under regimes that ask who was responsible for an automated decision, DORA, NIS2, GDPR, HIPAA among them, and it maps cleanly onto control frameworks like ISO 42001, ISO 27001, SOC 2, and OSCAL-based reporting.
When your AI acts, record two identities, not one: the actor and the principal it acted for, captured together and sealed at the moment of the action. The strength of the principal comes from your identity provider. The durability of the record, the guarantee that no one quietly rewrites who the action counted against, is what Athena provides. Do not leave the most contested fact in your audit trail to be reconstructed from memory and a shift roster.
