on-behalf-of
In short: On-behalf-of describes an agent acting with a specific person's authority, such as a copilot sending email as its user. The agent should carry both its own identity and the person's, and never exceed the person's permissions. Microsoft uses the phrase for agents governed under Identity Governance.
Where does it show up in practice?
Check that logs record both the agent and the person, not only the user token.