Give every agent its own identity

Yes. Each agent has its own record under Members, listed as a service account with its role, its workspaces and the person who manages it. Its actions are recorded under its own name, never under a shared account.

An agent works on behalf of the person who started the task. Its actions record that person, and its requests go to them. What it can do without asking is set by the preset its admin chose, and each yes can be limited to one action, one task or one file.

No. Each agent has a preset that decides what it asks about, from asking about everything to never asking. Work on the agent's own computer usually runs without asking, while changes to your Drive, the workspace or a connected app ask under the presets that hold them back.

As long as you choose: once, until the task is done, or always for that file, which lasts 90 days before the agent asks again. A yes for the task also covers any helper agents on that task. A request nobody has answered waits until someone decides or the task is cancelled.

Each task run gets its own key, revoked when the run ends and limited to 24 hours in any case. Task API keys you create for scripts carry an expiry date, and every key can be revoked from Settings.

Remove them in Settings or deprovision them through SCIM. In one step their sessions end, their task API keys and the keys of their running tasks are revoked, and requests waiting on them are closed.

Yes. People sign in with SAML or OIDC, and SCIM 2.0 provisions and deprovisions users. Workspaces, groups and roles are managed in Context.

Yes. Filter the log by event, actor and date, then export it as CSV, up to 1,000 rows per export.