The kinds of actor a real system has
- A person, acting directly in the interface.
- An agent, acting inside a session a person authorized.
- A background process, running on a schedule with no human present.
- A provider callback, triggered by an external system's event.
Why fabricating a human is worse than admitting there isn't one
It is tempting to attribute an automated write to the account that configured the automation, because it makes the record look tidy. It also makes the log lie. If nobody authorized this particular write, the honest record has an empty authorizing person and a clearly named machine actor — which is the record you need when you are trying to work out why something changed at three in the morning.
Machine actors do not get extra rights
An agent operating on a person's behalf should be bounded by both the permissions the underlying integration grants and the permissions the authorizing person holds. The narrower of the two wins. An automation that can do more than the person who started it is a privilege escalation with a friendly name.