After a security audit, a company discovers that it cannot determine which commits in its repositories were authored by AI agents versus human developers over the past six months. The agent was configured to commit using a shared service account with no additional metadata. Which traceability mechanism should have been implemented from the start?

Git commit attribution is the primary traceability mechanism for code authorship. When an agent commits using a shared human service account with no additional metadata, its contributions are indistinguishable from human commits in the git log, PR history, and audit trails. This creates compliance, accountability, and debugging problems.

The correct approach is to have the agent commit with co-author trailer metadata, such as Co-authored-by: GitHub Copilot <[email protected]>, identifying it as an AI agent, and ideally use a dedicated bot account rather than a shared service account. A dedicated bot account makes commits immediately identifiable, and co-author trailer metadata makes the AI contribution explicit and machine-readable. GitHub's contribution graph and audit log tools parse these trailers, enabling retrospective queries like 'show me all commits by AI agents in the last six months.'

The separate-branch approach would work only while changes are in-flight on that branch. Once merged, individual commits lose the branch origin context, and branches are also easily deleted.

The inline-file-comment approach is noisy, invasive to source code, and does not integrate with standard git tooling. It would require parsing source files rather than git log to reconstruct authorship.

The separate-repository approach would fragment the codebase, break normal PR workflows, and is architecturally impractical for an agent that needs to modify code alongside human developers.

Dedicated bot accounts with co-author trailers are the standard, tool-native solution for AI commit traceability.