@binlogreader 

Thank you very much for the clear and detailed explanation.
This clarifies the distinction between pure SP mode and OBO.

My understanding is that, in pure SP mode without user_api_scopes, all Databricks actions initiated by the app are audited as the service principal. Therefore, the actual logged-in user cannot be identified from system.access.audit alone. In this case, acting_resource remains NULL, and run_by / run_as should not be treated as fields that provide the end-user identity for the Databricks Apps SP-mode scenario.

I also understand that the app can obtain the logged-in user identity from headers such as X-Forwarded-Email and record it in application-owned logs. However, if individual user attribution is required in the platform-owned audit trail, OBO is the appropriate mechanism.

We will perform a controlled test with a known user action and verify the actual records in system.access.audit. Thank you again for the practical guidance.