Does a provider record prove who performed the action?¶

Usually not by itself. A provider record can be strong evidence that an account, session, resource or network identifier was involved. Personal attribution requires further evidence showing who controlled it at the relevant time.

The named subscriber or account holder may be a useful starting point, but is not automatically the operator.

Establish what generated the record¶

Interpret provider fields using the provider's definitions. A value labelled device, location or login may be inferred, normalised or partial. An event may also be generated by provider automation such as content processing, synchronisation, security scanning or enforcement rather than by a customer action.

Preserve the native record and establish:

• the event type and timestamp basis;
• account, session, device and token identifiers;
• authentication and multi-factor events;
• source address and any known intermediary;
• API keys or application identities;
• recovery and control changes; and
• whether the event is customer action, provider automation or a derived alert.

Corroborate personal control¶

Accounts can be shared, compromised or automated; devices can be shared; tokens can be stolen. Compare the provider event with local device evidence, communications, session continuity, account changes and activity before and after it.

A provider's abuse classification or intelligence association may guide investigation but does not prove the subscriber's knowledge or identity. Report account- or session-level attribution first, then state separately whether the wider evidence supports a person.