The problems this exists to solve.
How it works for your team, day to day.
Every action has a name on it
Human activity attributes to SSO identity; agent activity attributes to a distinct agent identity rather than a shared service account. Every prompt, tool call, and policy decision lands in the record with an owner attached — which is the difference between an alert and an answer.
From event to full session in one pivot
Attribution makes investigation linear: start from any event and pivot into the complete session timeline — what was asked, what was retrieved, what was redacted or blocked, and what happened next. Forensic replay for agents reconstructs the full action sequence.
Attribution powers policy, not just forensics
Because identity is first-class, policy can be too: groups carry different rules, agents carry scoped permissions per tool call, and access reviews finally have an AI column — who used what, when, and under which policy.
The questions we hear most.
How does identity mapping work?
Through your existing IdP — Okta or Entra. Users are attributed via SSO; no separate identity store to maintain.
What about shared machines or contractors?
Attribution follows the authenticated identity, not the device — a shared workstation still yields per-person records as long as sessions are authenticated.
How are agent identities established?
Agents register distinct identities with scoped credentials, so two agents built on the same framework remain separately attributable in every log.
What does this mean for employee privacy?
Attribution is metadata-first: who used which tool under which policy. Content access is role-gated and every access to it is itself logged.