Why is workload identity different from a user account for an agent?

Workload identity identifies software, services, agents, or tools, while a user account identifies a person. This distinction matters because an AI agent may keep running after a user prompt, call tools in the background, or communicate with other services. If all actions are tied only to a human user, the enterprise may not know which agent or component actually made a request. Workload identity gives each running component its own identity, which can be authenticated, authorized, logged, and rotated. Diagrid Catalyst uses workload identity as part of its agent and MCP server security model.