After a security audit, a company discovers that it cannot determine which commits in its repositories were authored by AI agents versus human developers over the past six months. The agent was configured to commit using a shared service account with no additional metadata. Which traceability mechanism should have been implemented from the start?
Select an answer to reveal the explanation.
Short Explanation and Infographic
An AI agent that commits under a generic service account leaves no fingerprints — months later no one knows which code is human-written and which is machine-generated. Co-author trailers and a dedicated bot account are the standard traceability combo: the git log tells you who really did the work.
Full explanation below image
![2048x1536 landscape infographic titled 'AI Commit Traceability'. Left panel labeled 'BAD': git log showing 20 commits all from service-account@company.com, magnifying glass over them showing question mark 'Human or AI?', red audit warning icon. Right panel labeled 'GOOD': git log showing commits from copilot-agent[bot] with co-author trailer 'Co-authored-by: GitHub Copilot' visible in commit detail, green audit checkmark, filter command git log --author=copilot-agent returning clean results. Bottom: 'Dedicated bot account + co-author trailer = full traceability.' GitHub dark palette.](/media/github/gh-600/GH-600-e3-q009-infographic.webp)
Full Explanation
Git commit attribution is the primary traceability mechanism for code authorship. When an agent commits using a shared human service account with no additional metadata, its contributions are indistinguishable from human commits in the git log, PR history, and audit trails. This creates compliance, accountability, and debugging problems.
The correct approach is B: use a dedicated bot account whose commits are immediately identifiable, and include co-author trailer metadata in commit messages (e.g., Co-authored-by: GitHub Copilot <[email protected]>) that makes the AI contribution explicit and machine-readable. GitHub's contribution graph and audit log tools parse these trailers, enabling retrospective queries like 'show me all commits by AI agents in the last six months.'
Option A (separate branch) would work only while changes are in-flight on that branch. Once merged, individual commits lose the branch origin context. Branches are also easily deleted.
Option C (inline file comments) is noisy, invasive to source code, and does not integrate with standard git tooling. It would require parsing source files rather than git log to reconstruct authorship.
Option D (separate repository) would fragment the codebase, break normal PR workflows, and is architecturally impractical for an agent that needs to modify code alongside human developers.
Dedicated bot accounts with co-author trailers are the standard, tool-native solution for AI commit traceability.