A housing authority casework system must clearly distinguish, in every access decision, whether a request originated from a caseworker logging in directly or from an autonomous agent acting on its own schedule. Which Google Cloud capability provides this distinction?
Select an answer to reveal the explanation.
Short Explanation
Picture two badges that both open the same door — one says "human," the other says "agent." That's what a distinct principal type buys you: every access decision can see, plainly, which kind of actor made the request. Bolting a label onto a human's login doesn't create that separation; it just decorates the same badge.
Full Explanation
Agent Identity establishes autonomous agents as first-class principals distinct from human users, so IAM policies, audit logs, and access decisions can reliably tell whether a caseworker or an unattended agent made a given request. That distinction matters for casework systems where a policy might allow a human to override an exception but require an agent's equivalent action to route through additional review. Agent Registry tracks deployed agent versions and metadata, which is useful for knowing what code is running but says nothing about the principal type behind a live request. Agent Gateway inspects and logs traffic between agents and their tools, which is valuable for monitoring but happens downstream of the identity decision, not in place of it. Labeling a shared human account as "automated" is a workaround, not a control: it still authenticates as that one human's credentials, so any policy keyed to "is this a real person" can be silently defeated. A scope caveat: Agent Identity distinguishes the actor type, but authorization on top of it still needs explicit policy to treat agent-originated requests differently. As an operational check, an architect can pull an access log entry and confirm the principal field names an agent identity rather than a human user, even when the request pattern looks routine.