sub stays the citizen the whole way through. act.sub is what actually names the AI agent calling the API on their behalf - and the two are not the same claim.
An explainer on how Auth0 FGA, on-behalf-of token exchange, and Agent as Principal fit together in a real demo app - sign up and try it yourself, no login flow to imagine, it's live: