Identity inherited from the channel

What it looks like. The action is attributed to whoever owns the session, the token, or the email thread. A voice on the phone is the person it sounds like. A document that looks like a signed waiver is treated as a signed waiver.

Why it fails. Every one of those signals is now cheap to synthesize, and the audit trail records the impersonated principal's name, so the forgery becomes the official history.

Instead. Bind identity per action, not per session, with an attestation the channel cannot forge. Verify authorization artifacts against issuance records in the primary system, never against the document presented. Assume voice and video are synthesizable; use a second channel for consequential authorizations.