Topic

Identity-Propagation

Identity propagation is the process of passing user identity and authentication credentials through multiple systems, services, or computational layers while maintaining security and auditability. In AI governance contexts, it ensures that actions performed by AI systems can be traced back to the originating user or service account, enabling proper accountability and compliance with audit requirements. This is critical for organizations that need to enforce access controls, log decision-making trails, and demonstrate regulatory compliance when AI systems make decisions affecting users or data.

1 item

ResearchUS2026-06-28

Meta Sev-1 Incident Exposes a Structural Flaw in AI Agent Audit Design: Identity Did Not Propagate to the Model

A Sev-1 incident at Meta on March 18, 2026, resulted in an internal AI agent exposing sensitive user and company data to unauthorized engineers for approximately two hours. The root cause was twofold: user identity was not propagated to the model at inference time, and the audit layer was embedded inside the calling application rather than positioned as an independent inspection point. The incident produced no regulatory record at the moment of the access decision.

agentic-ai identity-propagation audit-failure data-exposure access-controls