A county clerk records agent must act using the identity of the specific clerk who invoked it, not a single shared service account, so IAM audit trails reflect the actual requester. What design achieves this?
Select an answer to reveal the explanation.
Short Explanation
An audit trail built on one shared service account is like a sign-in sheet where everyone just writes "staff" — logged, but useless for figuring out who did what. Identity propagation fixes that by having the agent act under each clerk's own identity, so the sheet actually names names. A free-text note, a tighter leash on the shared account, or a per-clerk rate limit all leave that same anonymous signature.
Full Explanation
Identity propagation carries the invoking clerk's own IAM identity through to the agent's execution, so every action the agent performs on that clerk's behalf is recorded under the clerk's actual identity rather than a generic shared one, which is precisely what an accurate IAM audit trail requires. Adding the clerk's name as a free-text note in the request payload doesn't change the identity IAM actually records; the audit trail still attributes the action to the shared service account, and a free-text field can be inaccurate, omitted, or unverifiable, unlike an enforced identity claim. A PAB policy that narrows what the shared service account can reach is a genuinely good complementary control for limiting blast radius, but it doesn't solve the stated problem: the audit trail would still show the same shared account as the actor for every clerk's actions, just with a smaller set of things that account can do. An Agent Gateway rate limit per clerk requires some way of distinguishing clerks to apply the limit, but rate-limiting traffic doesn't itself change what identity is recorded as having performed the action, so the underlying attribution problem remains. A scope caveat: propagating the clerk's identity depends on that identity being reliably established when the clerk first invokes the agent, so weak upstream authentication undermines the whole chain. As an operational check, an auditor can pull a records action from the log and confirm it names the specific clerk's identity rather than a generic shared account.