To determine whether an audit-log action was performed by an AI agent, inspect the event’s actor and delegation fields before looking at the service account name. In Microsoft Entra, check agentType on initiatedBy, performedBy, and targetResources; Microsoft documents that any value other than notAgentic indicates agent involvement. Then distinguish the originating principal from the identity that executed the operation and correlate the event with agent-runtime telemetry using a shared request, trace, thread, or run identifier.
A generic application or service account is not proof of human or AI activity. If several agents share that identity and the logs contain no delegation or run context, the event cannot establish which agent acted.
As an Amazon Associate I earn from qualifying purchases.
The evidence you need before calling an action agent-performed
An audit record answers several different questions that are often collapsed into one:
- Who initiated the work? This may be a human user, application, workflow, or another principal.
- Who performed the operation? A service agent, application identity, managed identity, or user account may have made the actual API call.
- What resource changed? The target and operation establish the business impact.
- Can the action be connected to an agent run? A request, trace, thread, or run identifier can link the downstream change to model and tool telemetry.
These are separate facts. A service identity can execute an operation on behalf of a user without proving that an AI agent selected the action. Conversely, an agent may be involved even when the downstream system records only an application identity. Classify an event as agent-involved only when an explicit agent marker, documented delegation context, or defensible runtime correlation supports that conclusion.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Microsoft Entra: start with agentType
Microsoft Entra’s Agent ID audit documentation provides the clearest direct test. Inspect the raw event, not just the abbreviated view in a portal, and examine agentType in each identity object that is present:
initiatedByidentifies the initiating identity.performedByidentifies the identity recorded as performing the activity.targetResourcescan contain identity information associated with the affected object.
Microsoft states that a value other than notAgentic indicates agent involvement. A value of notAgentic is evidence that the particular identity object is not marked as agentic; it does not, by itself, prove that no upstream agent influenced the business process. Compare all available identity objects and then check runtime telemetry.
Identity types that can appear
Entra documents different activity patterns for an agent identity, a blueprint, and an agent user account. Do not assume that the display name alone identifies the execution path. The same event can expose a human or application as the initiator while recording an agent-related performer. The documented auditActivityPerformer information can include agentType, appId, and blueprintId. Preserve these values in your investigation because the friendly name shown by a console may be insufficient for a unique match.
Recommended Free Tools
What to record from the raw event
For every candidate event, copy the event timestamp, operation name, resource identifiers, tenant or subscription context, and the complete initiatedBy, performedBy, and targetResources objects. Record the exact agentType value, appId, and blueprintId when present. Keep the raw JSON under your incident’s evidence controls so later enrichment does not overwrite the original record.
Separate the originating principal from the executor
Many agent architectures intentionally use two identities. An originating principal asks for work, starts a workflow, or grants approval. A service agent then calls the destination API. Treating the executor as the origin loses accountability; treating the origin as the executor hides the identity that actually held permission to change the resource.
Google Cloud delegation history
Google Cloud’s documented service-account examples show a serviceDelegationHistory structure that can carry the original principal, the service agent that executed the request, and the service to which that agent belongs. When this field is emitted, use it to build a two-stage attribution record:
- Capture the original principal exactly as logged.
- Capture the executing service agent and associated service.
- Verify that the delegation chain belongs to the same request and resource operation.
- Keep the chain with the event rather than replacing the original principal with the service agent name.
Delegation history is platform-specific. Its absence does not prove that no delegation occurred; it means that this log surface does not establish the chain. Check the identity provider, workload runtime, and destination application for additional context.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Why a service account name is not enough
A service account can run scheduled code, a human-triggered automation, a conventional integration, or an AI agent. The name usually identifies a credential, not the decision process that selected the action. If multiple agents use one account, an audit entry tied only to that account cannot distinguish them. Report the principal as a shared executor and mark per-agent attribution as unestablished unless a separate correlation record resolves it.
Correlate the audit event with agent-runtime telemetry
Destination audit logs often show only the final API call. Agent runtimes may hold the evidence for model invocation, tool selection, approval, retries, and policy checks. Correlation joins those layers.
Azure SRE Agent example
Azure SRE Agent documentation says the agent logs tool calls, model invocations, incident handling, and approval decisions to an Application Insights resource. It also describes a trace ID that correlates events within a request. Use that trace ID to move from a resource-changing operation to the agent activity that preceded it, then verify timestamps, target resource, and operation name.
Azure Activity Log covers Azure Resource Manager operations on the agent and related resources. It is therefore a different evidence surface from Application Insights. An Activity Log entry can prove that a resource-management operation occurred, while Application Insights can show the agent-side sequence that led to it. Neither surface should be treated as a complete substitute for the other.
OpenTelemetry GenAI attributes
OpenTelemetry GenAI semantic conventions include gen_ai.agent.id and gen_ai.thread.run.id. These attributes provide a consistent way to label agent and run telemetry inside an instrumented system. They are not a guarantee that every downstream audit system will receive or retain the values. Check whether your application propagates them across tool calls, queues, gateways, and API clients.
Correlation rules
- Prefer a stable identifier that is written by both the runtime and the destination application.
- Use timestamps and resource identifiers as supporting checks, not as the sole join key.
- Account for clock skew, retries, asynchronous queues, and batched operations.
- Require the correlated records to agree on the operation and target before assigning causation.
- Keep unmatched runtime events and unmatched audit events visible; forcing a match creates false certainty.
A practical investigation workflow
Use the following sequence for an existing incident. It is designed to produce a defensible answer even when the platform does not expose every agent field.
1. Define the event boundary
Start with a narrow time range and the exact resource or operation in question. Record the event ID, timestamp including time zone, destination system, operation, target resource, and tenant, project, subscription, or account. Export the raw record before filtering or normalizing fields.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
2. Inventory every identity object
List the user, application, service principal, managed identity, service account, and agent-related objects separately. Note whether each object is an initiator, performer, target-resource identity, or delegated identity. Do not collapse them into a single actor column.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →3. Check explicit agent markers
In Microsoft Entra, inspect agentType on initiatedBy, performedBy, and targetResources. A value other than notAgentic is Microsoft’s documented indication of agent involvement. Also preserve appId, blueprintId, and the documented auditActivityPerformer details when available.
4. Reconstruct delegation
Look for a delegation-history field or equivalent. In Google Cloud, inspect serviceDelegationHistory for the original principal, executing service agent, and associated service. If the destination system records only the executor, search the identity provider and workflow service for the initiating principal.
5. Find the runtime record
Search the agent’s telemetry for the same request, trace, thread, or run identifier. For Azure SRE Agent, begin with the Application Insights trace ID and then compare tool calls, model invocations, incident handling, and approval decisions with the destination event. For OpenTelemetry-instrumented systems, search attributes such as gen_ai.agent.id and gen_ai.thread.run.id.
6. Check the correct log surface
Separate agent execution from resource management. Azure Application Insights and Azure Activity Log illustrate why this matters: one records agent-side behavior, while the other records Azure Resource Manager operations. Other platforms may split identity, runtime, and application logs in different ways.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problems7. Test causation, not just proximity
Confirm that the correlated runtime record names the same resource and operation, falls within a plausible time window, and represents the successful attempt rather than a retry or failed preview. A nearby model invocation is not enough if another workflow could have made the change.
8. Write the conclusion with an evidence level
Use precise language:
- Confirmed agent involvement: an explicit agent marker or a documented agent identity is present, and the operation is linked to the event.
- Delegated execution established: the original principal and executing service agent are both recorded, even if the service does not expose model details.
- Probable but not proven: runtime telemetry and timing align, but the destination audit record lacks an explicit agent marker.
- Not established: only a shared service account or ordinary application identity is recorded, with no delegation or runtime correlation.
How platform approaches differ
| Approach | Actor specificity | Delegation visibility | Runtime correlation | Coverage boundary | Main limitation |
|---|---|---|---|---|---|
| Microsoft Entra agent fields | agentType on identity objects; may include agent, blueprint, or agent user context |
Depends on the event’s initiating and performing objects | Requires a separate runtime identifier or telemetry source | Entra audit activity and related identity records | Downstream applications may not preserve the marker |
| Google Cloud service delegation | Separates original principal from executing service agent when emitted | serviceDelegationHistory can show principal, agent, and service |
Depends on the application and service logs | Cloud service-account and service-agent events | Not every destination record carries the full chain |
| Azure SRE Agent telemetry | Agent-side events identify tool calls, model invocations, approvals, and incident handling | Can be joined to resource operations through trace context | Application Insights trace ID | Agent runtime in Application Insights; resource operations in Azure Activity Log | Trace propagation must survive the full request path |
| OpenTelemetry GenAI conventions | gen_ai.agent.id labels instrumented telemetry |
Not a delegation system by itself | gen_ai.thread.run.id and other propagated context can help |
Any instrumented runtime and exporter | Attributes may be dropped before reaching the destination audit log |
This comparison describes documented capabilities, not a cross-platform performance ranking. Your tenant, agent runtime, SDK, exporter, and destination application determine which fields are actually present.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Common failure modes and what to do
The event shows only a human user
A user identity may have approved a step, launched a workflow, or directly performed the operation. Search for a related application, workflow, or agent run before concluding that the user made the API call personally. If no such record exists, report that the audit event establishes user attribution only.
The event shows only one service account
Search for delegation history and runtime correlation. If several agents share the account and no unique run or trace identifier is preserved, per-agent attribution is impossible from that record. Do not infer an agent from naming conventions, timing alone, or the presence of an AI-related application elsewhere in the environment.
Free tools Windows power users keep installed
One-click scans. No signup required.
agentType is missing
Missing fields can result from an event type that does not support agent metadata, an older schema, an ingestion transform, or a downstream system that stripped identity details. Check the original provider record and schema documentation. Absence of agentType is not equivalent to notAgentic.
The runtime trace exists but the destination event has no trace ID
Compare operation, target, principal, and tightly bounded timestamps, then document the join as indirect. For future events, propagate a request or run identifier through the tool client and write it into the destination application’s audit metadata where supported.
Several events share one trace
A trace can contain planning, retries, approvals, and multiple tool calls. Match the specific span or run to the changed resource and successful operation. Treat the trace as a container, not as proof that every event inside it caused every downstream change.
Identity names disagree across systems
Prefer immutable identifiers such as object IDs, application IDs, blueprint IDs, or service-agent identifiers. Display names can change, be localized, or be reused. Preserve both the immutable value and the name shown at the time of the event.
Designing new deployments for reliable attribution
Give agents distinct service identities
AWS Agentic AI Lens guidance recommends distinct agent service identities and hard trust boundaries so attribution remains unambiguous and an agent cannot move into a human-designated role space through misconfiguration. Apply the principle even when your cloud is not AWS: one identity per agent or tightly bounded agent class is easier to investigate than one credential shared by many autonomous workflows.
Preserve both origin and execution
Record the requesting principal, the executing agent or service, the delegated service, and the authorization decision. Keep these as separate fields. Replacing the origin with the executor makes later review unable to distinguish a user request from an autonomous trigger.
Propagate a run-level correlation key
Create or retain a request, trace, thread, or run identifier at the agent boundary and carry it through queues, tool calls, API gateways, and destination applications. OpenTelemetry attributes such as gen_ai.agent.id and gen_ai.thread.run.id can structure runtime telemetry, but verify that your exporters and application logs retain them.
Log decisions as well as tool calls
For high-impact actions, retain the selected tool, arguments after policy filtering, approval or denial, model invocation metadata allowed by your privacy rules, retry history, and final result. Azure SRE Agent’s documented categories—tool calls, model invocations, incident handling, and approval decisions—illustrate the level of runtime context needed to explain a resource-changing event.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Test the complete path
Run a controlled action in each destination system and inspect every hop. Verify that the agent marker or identity survives ingestion, that the delegation chain remains intact, and that the correlation identifier is searchable in both runtime and application logs. Repeat after changing SDKs, gateways, exporters, or audit pipelines.
What a defensible incident note should contain
A useful note lets another investigator reproduce your conclusion without guessing. Include:
- The exact event and raw record location.
- Operation, target resource, timestamp, and time-zone handling.
- Initiating, performing, delegated, and target-resource identities.
- Explicit agent markers and their literal values.
- Runtime trace, request, thread, or run identifiers.
- The log surfaces consulted, such as identity audit, runtime telemetry, and resource Activity Log.
- Whether the link is direct, delegated, indirect, or unestablished.
- Any missing fields, retention gaps, clock uncertainty, retries, or shared identities that limit the conclusion.
The final statement should be narrow enough to survive review: identify the evidence that proves agent involvement, distinguish it from evidence that proves only service-account execution, and say when the available logs cannot identify an individual agent.
Limits of cross-platform attribution
Microsoft Entra, Google Cloud, Azure Application Insights, Azure Activity Log, Microsoft 365 audit records, and OpenTelemetry expose different schemas and retention behavior. Microsoft 365 audit documentation includes examples for Copilot and AI application identities, but the fields available to a particular tenant and workload still need verification. No single field is a universal standard for all audit systems.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteOfficial platform documentation does not establish a general percentage of audit events that identify AI-agent actions. It also does not guarantee that downstream applications preserve agent identity or delegation context. Validate the actual emitted schema and perform an end-to-end test. If the destination record lacks the needed context, the accurate result is that per-agent attribution is not established—not that a human, service account, or particular agent must have caused the action.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
