Attribution of action is the process of deciding who is legally or operationally responsible for something a system did. In cybersecurity, this matters whenever software acts on behalf of a person, organization, or another system. The question is not whether the software had intent; it is whether the action was authorized, within scope, and traceable to the right principal.
This concept shows up in AI agents, automation platforms, API integrations, and delegated credentials. If an agent accepts terms, sends data, or triggers a payment, defenders need to know whether that act binds the user or should be treated as abuse. Strong controls include least privilege, approval workflows, signed audit logs, and clear revocation paths. In attacks, adversaries often exploit weak attribution by abusing shared accounts, stolen tokens, or overbroad automation so that harmful actions appear legitimate.