The agent did the work. The audit log couldn’t say who asked.

The New Stack · 6 days ago · 22

CloudBolt reviewed more than 20% of customer and prospect MCP-related access policies and found they were broken or missing in ways that left audit logs unable to identify who requested or approved agent actions. The account reports the issue in over 20 percent of the policies, and it notes this is tied to MCP servers using personal tokens instead of service accounts. The resulting focus is on tracing agent activity back to responsible humans, as reflected by the planned live demo webinar on Oct. 27 at 12 p.m. Eastern.