The git identity is the entire mechanism. Claude Desktop was signing with the user.name and user.email configured at setup, so the commit object carried a human author, and blame and code ownership read that human [1]. Four or five of those changes had actually been looked at [2]. Against a branch of about sixty, that is roughly 92 percent arriving unexamined under the name of the person who reviewed it [3].
Moving the model to a server changes where the process runs, not what the credential says. The working copy is provisioned per ticket in an isolated environment and the output is a URL, which is what killed the port conflicts and the dependency drift [3]. The credential inside that environment is one service account, used by every run, for every person, on every ticket [4].
The author's test is four questions lifted from HR and asset management: who is it, what can it reach, what did it do, and how do you get rid of it [5]. A new hire clears all four, down to an offboarding procedure that takes an afternoon [6]. So does the printer on the third floor, which sits on a segment that reaches the print server and nothing else, logs every job, and can be unplugged [7]. The printer is the better-governed actor in the building, and it manages that without shipping an SDK.
Now score the agent. Identity: a key minted from a human account, usually the builder's, so downstream logs name that person [8]. Scope: whatever that person could reach, which for an engineer with admin rights is usually everything [9]. Audit: indistinguishable from what the human did [10]. Revocation: rotate the key and find out what else breaks [11]. The agent fails on all four counts [1]. The agent inherited the CRM write from the account it borrowed, an inheritance no one signed off on [12].
The reason teams do not simply mint one identity per agent is a licensing model. API-native providers issue a key with its own name and its own permissions, no seat required, and the source names Anthropic, OpenAI and Stripe [13]. Salesforce, HubSpot and most CRMs model access as seats occupied by people, so a distinct agent identity means buying a seat or sharing a credential, and sharing is what teams choose [14]. The scope tradeoff pushes the same way: narrow operation-level scopes break more often, and the break lands on whoever understands the permission model rather than whoever is operating the agent [15].
What the team ended up building was a number per run, stamped into the commit, into each API call, and into the originating ticket, so anything touched traces back to one run and to whoever started it [16]. The author prices that as a twenty-minute investigation instead of a week of reading diffs [17]. Read the week as five eight-hour days and the ratio is 2,400 minutes against 20, about 120x [2]. For that to transfer, the run ID has to survive into every system the agent writes to, which means each of those systems accepts an arbitrary correlation field and keeps it queryable. Git trailers and Slack messages do. A CRM record written through a shared seat often has nowhere to put it, and that is precisely the system where the identity was compromised to begin with.
The supplied text breaks off asserting that revocation and identity are the same question [18]. On the evidence above, that holds: if you cannot say how a credential gets switched off without a blast radius, the thing holding it belongs to someone else.
