@@ -0,0 +1,15 @@
+---
+'@objectstack/plugin-auth': patch
+'@objectstack/plugin-audit': patch
+---
+
+fix(plugin-auth,plugin-audit): a SCIM-driven write names the SCIM connection that performed it, on its audit row
+
+Clause-②: yes (widening) — `authSystemWriteContext()`, published through `export * from './auth-actor-attribution.js'`, now declares an optional `actor` member on the context it returns; nothing it returned before is removed or narrowed.
+Metadata-protocol: none
+
+An identity provider's SCIM writes (the `sys_user` create, the deactivation's ban update, the delete, and the `sys_scim_*` rows written beside them) used to leave `sys_audit_log` rows with `actor`, `user_id` and `metadata` all null, so no row said which SCIM connection (which IdP) acted, and "who deactivated this account" had no answer.
+
+- **`@objectstack/plugin-auth`.** The SCIM request scope `handleRequest` opens around every `/scim/v2/*` request now carries the connection the bearer verified as: the bearer verifier records it, and `authSystemWriteContext()` gives every write of that request `actor: 'svc:scim:CONNECTION_ID'` on `ExecutionContext.actor`, with no `attributedUserId`. The connection id is the label's identifier because it is immutable and keys every resource the connection provisions. Writes outside a SCIM request are unchanged.
+- **`@objectstack/plugin-audit`.** The audit writer records that label on `sys_audit_log.actor`, as it records any service principal, and the connection id alone as `metadata.scim_connection_id`, read off the same label so the two never disagree. `user_id` stays null, because no human acted. Rows of every other actor are unchanged.
+- **Never on a row:** the bearer, its digest and the credential row stay out of the write context, so none of them can reach `actor`, `metadata` or any other column.
@@ -2997,3 +2997,74 @@ describe('audit writers — the activity row of an org-less record names the der
     expect(asked).toBe(0);
   });
 });
+
+/**
+ * [#30960] A SCIM connection's write names the connection, and only that write.
+ *
+ * plugin-auth hands every write of a SCIM protocol request to the engine as
+ * `{ isSystem: true, actor: 'svc:scim:CONNECTION_ID' }` with no
+ * `attributedUserId` (pinned at the engine by plugin-auth's
+ * `scim-transaction-scope.test.ts`, which spells the same label), and the
+ * engine surfaces it as `session.actor`. The ledger row then carries the
+ * label on `actor`, the connection id alone as `metadata.scim_connection_id`,
+ * and a null `user_id`: no human acted.
+ */
+describe('audit writers — a SCIM connection is the actor of its writes (#30960)', () => {
+  const SCIM_ACTOR = 'svc:scim:okta-30960';
+
+  it.each([
+    ['the SCIM create', 'afterInsert', 'create', { result: { id: 'u_1', email: 'ann@example.com' } }],
+    [
+      'the deactivation’s ban update',
+      'afterUpdate',
+      'update',
+      { previous: { id: 'u_1', banned: false }, result: { id: 'u_1', banned: true } },
+    ],
+    ['the delete', 'afterDelete', 'delete', { previous: { id: 'su_1', user_name: 'ann' }, result: { id: 'su_1' } }],
+  ])('%s: actor names the connection, metadata carries its id, user_id stays null', async (_label, event, action, rows) => {
+    const { engine, fire, created } = makeEngine(SINGLE_TENANT);
+    installAuditWriters(engine as any, 'test.audit');
+    await fire(event, {
+      object: action === 'delete' ? 'sys_scim_user' : 'sys_user',
+      input: { id: (rows.result as { id: string }).id },
+      ...rows,
+      session: { isSystem: true, actor: SCIM_ACTOR },
+    });
+    const audit = created.find((c) => c.object === 'sys_audit_log');
+    expect(audit?.row.action).toBe(action);
+    expect(audit?.row.actor).toBe(SCIM_ACTOR);
+    expect(audit?.row.user_id).toBeNull();
+    expect(JSON.parse(audit?.row.metadata)).toEqual({ scim_connection_id: 'okta-30960' });
+  });
+
+  it('another service principal’s row is unchanged: actor recorded, no metadata', async () => {
+    for (const actor of ['svc:cloud-control', 'svc:flow:mirror_status', 'svc:scim']) {
+      const { engine, fire, created } = makeEngine(SINGLE_TENANT);
+      installAuditWriters(engine as any, 'test.audit');
+      await fire('afterInsert', {
+        object: 'crm_lead',
+        input: { id: 'lead-1' },
+        result: { id: 'lead-1', name: 'Acme' },
+        session: { isSystem: true, actor },
+      });
+      const audit = created.find((c) => c.object === 'sys_audit_log');
+      expect(audit?.row.actor, actor).toBe(actor);
+      expect(audit?.row.metadata, actor).toBeUndefined();
+    }
+  });
+
+  it('a user’s write carries no SCIM key even beside a SCIM label: the user is the actor', async () => {
+    const { engine, fire, created } = makeEngine(SINGLE_TENANT);
+    installAuditWriters(engine as any, 'test.audit');
+    await fire('afterInsert', {
+      object: 'crm_lead',
+      input: { id: 'lead-1' },
+      result: { id: 'lead-1', name: 'Acme' },
+      session: { userId: 'user-7', actor: SCIM_ACTOR },
+    });
+    const audit = created.find((c) => c.object === 'sys_audit_log');
+    expect(audit?.row.actor).toBe('user-7');
+    expect(audit?.row.user_id).toBe('user-7');
+    expect(audit?.row.metadata).toBeUndefined();
+  });
+});
@@ -91,6 +91,7 @@ import {
 import type { LedgerRecordWriteAction } from './audit-log-field-redaction.js';
 import { SIGN_IN_STAMP_EVENT, isSignInStamp } from './sign-in-stamp.js';
 import { IMPERSONATED_BY_KEY, IMPERSONATED_BY_NAME_KEY, impersonatorOf } from './impersonation-attribution.js';
+import { SCIM_CONNECTION_ID_KEY, scimConnectionOf } from './scim-connection-attribution.js';
 import type { MentionGateInput } from './mention-recipient-gate.js';
 // [ADR-0139 E6] The ONE derivation of the two writer-stamped columns the
 // withheld-row rule reads, shared with the before-insert hook and the backfill.
@@ -2105,6 +2106,11 @@ export function installAuditWriters(
     // a strict sys_user lookup); the service principal lands on `actor`.
     const actorLabel: string | null =
       userId ?? (typeof sess.actor === 'string' && sess.actor.trim() ? sess.actor.trim() : null);
+    // [#30960] The SCIM connection an identity provider's provisioning write
+    // was performed by: read off the label `actor` carries
+    // (`svc:scim:CONNECTION_ID`, see `scim-connection-attribution.ts`), so the
+    // association field and the column can never disagree.
+    const scimConnectionId: string | undefined = scimConnectionOf(actorLabel);
     // [commit 1408fe385, honouring #8287's ruling] The audited RECORD'S OWN organization
     // wins; the acting session's active organization is the fallback. ⛔ Do not
     // flip this back to `sess.organizationId ?? recordOrgId`.
@@ -2227,13 +2233,19 @@ export function installAuditWriters(
     // `impersonated_by` follows the same rule: present ONLY on a write made
     // from an impersonation session, beside a `user_id` that stays the
     // impersonated user. No key ⇒ that user acted themselves.
-    if (performedByClientId || impersonatedBy || signInStamp) {
+    //
+    // `scim_connection_id` follows the same rule: present ONLY on a write a
+    // SCIM connection performed, beside the `svc:scim:CONNECTION_ID` actor it
+    // is read from and a `user_id` that stays null. No key ⇒ no SCIM
+    // connection acted.
+    if (performedByClientId || impersonatedBy || signInStamp || scimConnectionId) {
       auditRow.metadata = safeStringify({
         // A sign-in stamp names its event the way a `config_change` row does
         // (`metadata.event`); every other CRUD row still carries no event.
         ...(signInStamp ? { event: SIGN_IN_STAMP_EVENT } : {}),
         ...(performedByClientId ? { performed_by: performedByClientId, on_behalf_of: userId ?? null } : {}),
         ...(impersonatedBy ? { [IMPERSONATED_BY_KEY]: impersonatedBy } : {}),
+        ...(scimConnectionId ? { [SCIM_CONNECTION_ID_KEY]: scimConnectionId } : {}),
       });
     }
 
 
@@ -0,0 +1,49 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * Which SCIM connection performed a write — the metadata key the audit writer
+ * stamps on a SCIM-provisioned row, in one place.
+ *
+ * An identity provider (Okta, Entra ID) provisions, deactivates and
+ * deprovisions users through the SCIM 2.0 endpoints, authenticated by a bearer
+ * that `@objectstack/plugin-auth` verifies as one CONNECTION. No human acts, so
+ * the row's `user_id` stays null. plugin-auth names the connection as the
+ * write's service principal on the attribution-only `ExecutionContext.actor`,
+ * spelled `svc:scim:CONNECTION_ID` (`scimServicePrincipal` in plugin-auth's
+ * `scim-connection-service.ts`, the incumbent `svc:<name>` shape of ADR-0014
+ * D2), and the engine hands it to hooks as `HookContext.session.actor`. The
+ * writer records it on `sys_audit_log.actor`, as it does every service
+ * principal, and ALSO under this key:
+ *
+ *  - `sys_audit_log.metadata.scim_connection_id` — the connection id alone, so
+ *    an auditor (or the audit export) asks "which connection did this" of a
+ *    named field rather than by parsing the label (ADR-0118 D5: "which
+ *    non-user acted" is answered by an association field).
+ *
+ * One source, so the two never disagree: the key is READ OFF the label the
+ * `actor` column carries, never off a second carrier. It is present only on a
+ * row whose actor is a SCIM connection; the ABSENCE is the record that no SCIM
+ * connection performed the write. Nothing in the authorization path reads it,
+ * and neither the bearer nor its digest ever reaches the label.
+ *
+ * The prefix is spelled here rather than imported: this package does not
+ * depend on `@objectstack/plugin-auth`. The two spellings are held equal by
+ * plugin-auth's `scim-transaction-scope.test.ts` (the label its writes carry)
+ * and this package's `audit-writers.test.ts` (the label this module reads).
+ */
+
+/** The `ExecutionContext.actor` prefix of a SCIM connection's service-principal label. */
+export const SCIM_SERVICE_PRINCIPAL_PREFIX = 'svc:scim:';
+
+/** The metadata key naming the SCIM connection that performed the write. */
+export const SCIM_CONNECTION_ID_KEY = 'scim_connection_id';
+
+/**
+ * The SCIM connection a row's actor label names, or `undefined` when the actor
+ * is not a SCIM connection (a user id, another service principal, or none).
+ */
+export function scimConnectionOf(actorLabel: string | null | undefined): string | undefined {
+  if (typeof actorLabel !== 'string' || !actorLabel.startsWith(SCIM_SERVICE_PRINCIPAL_PREFIX)) return undefined;
+  const connectionId = actorLabel.slice(SCIM_SERVICE_PRINCIPAL_PREFIX.length);
+  return connectionId.length > 0 ? connectionId : undefined;
+}
@@ -61,6 +61,7 @@
 
 import { AsyncLocalStorage } from 'node:async_hooks';
 import { agentForwardPerformedBy } from './agent-forward-identity-view.js';
+import { scimRequestConnectionId, scimServicePrincipal } from './scim-connection-service.js';
 
 /**
  * The human a better-auth write is credited to, as the session names them.
@@ -212,10 +213,21 @@ function attributedActorOf(resolved: Awaited<ReturnType<AuthActorResolver>>): At
  */
 export async function authSystemWriteContext(): Promise<{
   isSystem: true;
+  actor?: string;
   attributedUserId?: string;
   impersonatedBy?: string;
   performedBy?: { clientId: string };
 }> {
+  // [#30960] A SCIM protocol request is performed by the identity provider's
+  // CONNECTION, which its bearer verified as — no human acted. Its writes are
+  // attributed to that connection as a service principal, on
+  // `ExecutionContext.actor` (`svc:scim:CONNECTION_ID`, see
+  // `scimServicePrincipal`), and `attributedUserId` stays absent, so
+  // `sys_audit_log.user_id` stays null.
+  const scimConnectionId = scimRequestConnectionId();
+  if (scimConnectionId !== undefined) {
+    return { isSystem: true, actor: scimServicePrincipal(scimConnectionId) };
+  }
   const actor = await resolveAttributedActor();
   const attributedUserId = actor?.userId;
   // An impersonation session's write is credited to the impersonated user
 
@@ -793,7 +793,9 @@ export async function buildPluginList(this: PluginListHost): Promise<any[]> {
   if (enabled.scim) {
     await this.addOptionalPlugin(plugins, 'scim', async () => {
       const { scim } = await import('@better-auth/scim');
-      const { verifyScimBearerToken } = await import('./scim-connection-service.js');
+      const { verifyScimBearerToken, recordScimRequestConnection } = await import(
+        './scim-connection-service.js'
+      );
       const secret = this.resolveAuthSecret();
       return scim({
         connections: [],
@@ -811,7 +813,15 @@ export async function buildPluginList(this: PluginListHost): Promise<any[]> {
             // POST + PATCH; pinned by `scim-transaction-scope.test.ts`).
             const engine = this.config.dataEngine;
             if (!engine) return null; // no store to verify against — fail closed
-            return verifyScimBearerToken(engine as never, secret, input.token);
+            // The verified connection is WRITTEN INTO the scope
+            // `handleRequest` opened — a field on the store both this frame
+            // and the endpoint handler read — not entered as a new store, so
+            // every provisioning write of the request is attributed to it
+            // (`ScimRequestScope.connectionId` says why that reaches the
+            // writes where an `enterWith` did not).
+            return recordScimRequestConnection(
+              await verifyScimBearerToken(engine as never, secret, input.token),
+            );
           },
         },
         // [#14360] The host half of `active`: stable @better-auth/scim
 
@@ -754,6 +754,9 @@ export function withSystemContext(engine: IDataEngine): IDataEngine {
   // better-auth-owned write: the attributed human, the administrator
   // impersonating them on an impersonation session, and a forwarded AI agent's
   // client ([ADR-0090 D10 rule 5, #28367]), so the audit row records each side.
+  // Inside a SCIM protocol request it is the verified connection instead, as
+  // the service principal `actor: 'svc:scim:CONNECTION_ID'` with no human
+  // ([#30960]; `ScimRequestScope.connectionId` says how it reaches here).
   const asAttributedSystem = async (q: any) => ({
     ...(q ?? {}),
     context: { ...(await authSystemWriteContext()), ...(q?.context ?? {}) },
 
@@ -74,14 +74,93 @@ import { AsyncLocalStorage } from 'node:async_hooks';
  * locally (#3653). Core flows never had native DB transactions before (the
  * adapter factory's default is the sequential as-is fallback), so this keeps
  * them at their historical posture rather than weakening anything.
+ *
+ * The store also carries the request's ATTRIBUTION slot — see
+ * {@link ScimRequestScope.connectionId}.
  */
-export const scimRequestScope = new AsyncLocalStorage<{ scim: true }>();
+export const scimRequestScope = new AsyncLocalStorage<ScimRequestScope>();
+
+/**
+ * One SCIM protocol request's scope: opened empty by `handleRequest`, its
+ * `connectionId` filled in once by the bearer verifier.
+ */
+export interface ScimRequestScope {
+  scim: true;
+  /**
+   * The SCIM connection this request's bearer verified as — the IdP that is
+   * acting. Recorded by {@link recordScimRequestConnection} from inside the
+   * `verifyBearerToken` callback; read by {@link scimRequestConnectionId} when
+   * the adapter builds each write's context (`authSystemWriteContext`), so
+   * every provisioning write of the request — the `sys_user` create, the
+   * deactivation's ban update, `sys_member`, `sys_scim_*` — is attributed to
+   * the connection.
+   *
+   * Why a MUTABLE slot on a store `handleRequest` already opened, and not a
+   * new store: the verifier runs in a continuation the endpoint handler does
+   * not descend from (the `enterWith` note above, measured). A store the
+   * verifier opened or entered never reaches the writes. The object opened
+   * here, though, is the store of BOTH frames — the verifier's and the
+   * handler's — because both run inside the one `run(...)`; writing a field
+   * on it is seen by every later read in the request. Each request gets its
+   * own object from its own `run(...)`, so two concurrent requests on two
+   * connections never see each other's slot (pinned by
+   * `scim-transaction-scope.test.ts`, the attribution block).
+   *
+   * Only the connection id is kept. The bearer, its digest and the credential
+   * row are never placed here, so no write context can carry them.
+   */
+  connectionId?: string;
+}
 
 /** Is the current async chain inside an authenticated SCIM protocol request? */
 export function inScimRequestScope(): boolean {
   return scimRequestScope.getStore()?.scim === true;
 }
 
+/**
+ * Record the connection a SCIM bearer verified as on the current request's
+ * scope, and hand the verification back unchanged.
+ *
+ * A no-op outside a SCIM request scope, on a failed verification (`null`), and
+ * once a connection is already recorded: the first verified connection of a
+ * request is the one its writes are attributed to, so a later call cannot
+ * re-attribute writes already in flight.
+ */
+export function recordScimRequestConnection<T extends ScimBearerVerification | null>(verification: T): T {
+  const scope = scimRequestScope.getStore();
+  if (scope?.scim === true && verification && scope.connectionId === undefined) {
+    scope.connectionId = verification.connection.id;
+  }
+  return verification;
+}
+
+/** The connection the current SCIM request's bearer verified as, or `undefined`. */
+export function scimRequestConnectionId(): string | undefined {
+  const scope = scimRequestScope.getStore();
+  return scope?.scim === true ? scope.connectionId : undefined;
+}
+
+/**
+ * The service-principal label of a SCIM connection, as it lands on
+ * `ExecutionContext.actor` and from there on `sys_audit_log.actor`.
+ *
+ * `svc:scim:CONNECTION_ID` — the incumbent `svc:<name>` shape
+ * (`ExecutionContext.actor`, ADR-0014 D2) with the kind segment first, the way
+ * an automation run is `svc:flow:FLOW_NAME`. The connection id is the
+ * identifier and not a display name: it is immutable, it scopes every resource
+ * the connection provisions, it is what `sys_scim_connection_binding` and
+ * `sys_scim_connection_credential` are keyed by, and the credential row holds
+ * no connection name to use instead (its `label` names one credential, which a
+ * rotation replaces). The audit writer also records the id on its own, as
+ * `metadata.scim_connection_id` (ADR-0118 D5's association field).
+ */
+export function scimServicePrincipal(connectionId: string): string {
+  return `${SCIM_SERVICE_PRINCIPAL_PREFIX}${connectionId}`;
+}
+
+/** The `ExecutionContext.actor` prefix every SCIM connection's label starts with. */
+export const SCIM_SERVICE_PRINCIPAL_PREFIX = 'svc:scim:';
+
 /** The ObjectStack-owned credential store (see platform-objects/identity). */
 export const SCIM_CREDENTIAL_OBJECT = 'sys_scim_connection_credential';