A correlation ID is a shared identifier attached to related events so they can be connected across services, applications, and logs. For example, a system can carry the same ID from an AI agent’s request through an orchestrator, a tool call, and the resulting approval or action.
In cybersecurity, correlation IDs help defenders reconstruct activity, investigate errors, and distinguish one workflow from another when records are spread across systems. They do not prove who initiated an action or whether it was authorized, so they should be used alongside identity, timestamps, permissions, and tamper-resistant logging. Avoid reusing IDs across unrelated operations, and preserve them consistently across system boundaries.