Lab: ask the log who did it

The fleet lesson said attribution collapses onto one identity when agents share a credential, and that this satisfies retention while answering nothing. It is a two-line difference in the log and a total difference in what you can say.

1. 1

   Build the same activity twice, differing only in who it is attributed to.

   bash Copy

   cat > /tmp/attr.py <<'EOF'
   ACTIONS = [("app/key",), ("prod/db/root",), ("app/config",)]
   
   shared = [{"actor": "fleet-agent", "target": t[0]} for t in ACTIONS]
   scoped = [{"actor": a, "target": t} for a, t in
             [("agent-search",  "app/key"),
              ("agent-billing", "prod/db/root"),
              ("agent-search",  "app/config")]]
   
   q = "who read prod/db/root?"
   for name, log in (("one shared identity", shared),
                     ("one identity per job", scoped)):
       who = {e["actor"] for e in log if e["target"] == "prod/db/root"}
       print(f"{name:22} {q} -> {who}")
   EOF
   python3 /tmp/attr.py

2. 2

   Both logs recorded the read. Only one of them answered the question.

   text Copy

   one shared identity    who read prod/db/root? -> {'fleet-agent'}
   one identity per job   who read prod/db/root? -> {'agent-billing'}

3. 3

   Clean up.

   bash Copy

   rm /tmp/attr.py

Both logs are complete, tamper-evident and correctly retained. The shared one is also useless for the only question anyone asks during an incident.

• fleet-agent is a true answer and not an informative one. It names the credential rather than the workload, and during an incident you need to know which workload to stop.
• It also removes your ability to scope a response. With one identity you revoke everything or nothing; with several you revoke the one that misbehaved.
• And it removes the blocked-event signal, because you can no longer tell which agent is repeatedly attempting something it is not permitted to do.