EAF-2 — Unattributed Actor

There is no verified answer to the question: who or what is executing this?

DENY actor unknown
ESCALATE identity asserted but not authenticated

Definition

The entity requesting execution cannot be attributed: it is unauthenticated, shared, or ambient. Shared credentials, org-wide tokens, and agent processes that act under a platform identity rather than an identity of their own all produce executions with no accountable actor.

Attribution is not a logging nicety. Authority is a property of an actor; if the actor is unattributed, no authority can attach to the execution at all.

How it appears

One service token used by many pipelines, so any mutation could have come from any of them.
Cron jobs and daemons running as admin or a team account.
Agent frameworks where every agent acts as the platform, with no per-agent identity and no link to the initiating human.
Production access through a bastion under a shared login.

Across actors

Agent

Several autonomous agents share one API key. When one of them deletes a resource, the mutation cannot be attributed to a specific agent, a specific task, or the human who initiated it.

CI / pipeline

A runner authenticates with an organization-wide personal access token. Every repository’s pipeline mutates state as the same anonymous super-actor.

Human operator

An on-call engineer makes an emergency change through a team login. Three weeks later, nobody can say who acted.

Why it defeats admissibility

Every downstream admissibility question presumes a subject. “Is the actor authorized?” is unanswerable when the actor is a crowd or a ghost. Unattributed executions also destroy accountability after the fact: an incident review over shared credentials ends at the credential, not at a decision-maker.

Remediation

Give every executing entity its own identity — including per-agent identities distinct from the operator who launched them.
Authenticate identity at the boundary and record actor.type and actor.id in the JExec Record.
Forbid shared credentials for any execution classed as a mutation.

In the JExec Record

Primarily affects: actor. The JExec Protocol maps EAF-2 to the consequences above; JExec Check detects it deterministically and links back to this page.