A warehouse's query log now names a distinct account per job rather than one shared login — what does that let you answer, and what not?

## What a shared login costs you in the record A downstream system records what an account did. If ten analytical jobs share one login, its record says that same account ran all of it. Attributing any single query to a job then means reconstructing it from outside: this job runs at the top of the hour, that one on demand, this query looks like the shape that one issues. It works until two consumers overlap, until someone runs an ad-hoc query with the same credential, or until the question being asked is precisely the one where guessing is not good enough — *which consumer read this dataset at 03:40?* The shared login has not hidden the activity. It has removed the **name** from it. ## What the per-consumer account restores When the store creates a distinct principal per consumer, the downstream system's own record carries that name on every operation. Several things become lookups instead of investigations: - **Which consumer ran this query** — read the account on the row. - **Which consumer is responsible for this load or this cost** — group the record by account. - **What one consumer actually touched** — filter the record by account, over whatever window the system keeps. - **Whether a consumer is using rights it was granted but never needed** — compare what the account was granted against what it is recorded doing. Notice that all four are answered by the **downstream system's** record, not by the store's. That matters, because they are different records answering different questions: the store's records concern who asked for a credential, which is a separate subject; the warehouse's record concerns what was done with one. ## Making the name carry the information Attribution is only as good as the name the store chose. A random opaque identifier is a perfectly good account name and a useless log entry — you get a distinct principal per consumer and still have to look every one of them up somewhere else, which is the thing the shared login was already forcing you to do. So the name the store creates should encode the facts you will want at 03:40: 1. The **consumer** the credential was issued to, in the form the rest of the estate calls it. 2. Enough of the **request** to distinguish one issuance from the next for the same consumer. 3. Nothing secret — the name appears in a log, so it is not a place for any part of the value. ## What it still cannot tell you | Question | Does the per-consumer account answer it? | |---|---| | Which consumer ran this query | Yes, directly from the record | | Which human triggered that run | No — the account names a service, not a person | | Which host the query came from | Only if the system records the source separately | | Whether the value was copied off that host | No — a copy presents the same account | | What the consumer did outside this system | No — each system records only its own operations | The fourth row is the one candidates most often get wrong. A minted account identifies the **credential**, and anything holding that credential looks like the consumer it was issued to. If a second process on the same host reads the value out of the environment or the file it was written to, its queries are recorded under the consumer's name and are indistinguishable from the consumer's own. Per-consumer issuance narrows *how much* one leaked value reaches; it does not prove that only the intended process used it. ## Why this is worth saying out loud in an interview Two failure modes sit either side of this answer. One is dismissing attribution as bookkeeping — it is usually the first benefit an estate actually collects from per-consumer issuance, long before anyone measures a smaller blast radius. The other is overclaiming: describing the downstream record as though it identified people, or treating a name on a row as proof that nothing else used the credential. The accurate claim is narrow and useful: **the downstream system's own record now carries a name that means something, without anyone correlating clocks, and that name is the consumer, not the person and not the process.**