Non-repudiation is a security control that helps prove who performed an action and makes later denial difficult. It is usually built from strong identity checks, cryptographic signing, timestamps, and audit logs that link a specific user or system to a specific event. In practical terms, it answers questions such as: who sent this message, who approved this transfer, or which account changed this setting?
It matters because many attacks exploit ambiguity. An intruder may use a stolen account and later deny responsibility, or an insider may claim a sensitive action was automated or approved by someone else. Defenses rely on non-repudiation to preserve trust in logs, signed emails, signed code, privileged commands, and administrative workflows. In AI-heavy environments, such as a leader twin or other delegated system, non-repudiation also helps show whether a human reviewed, authorized, or merely generated a message, reducing confusion and accountability gaps.