The PR comment with your name and photo on it is the most convincing argument for agent identity I have read. I learned this the hard way too: my agent's actions were invisible in audit logs because everything ran under my token, so when something broke I could not separate my actions from the machine's. Service accounts with scoped permissions solved it, but the part that surprised me was how much the audit trail improved once actions had their own identity. Did you look at short-lived credentials per task, or only long-lived service accounts?