diff --git a/backend/app/utils/security.py b/backend/app/utils/security.py
index a78c1cb..75e7349 100644
--- a/backend/app/utils/security.py
+++ b/backend/app/utils/security.py
@@ -7,7 +7,13 @@ def get_actor(request: Request) -> str | None:
 
     This is the reserved placeholder from the contract — no authentication
     or authorization is enforced yet.
+
+    Services acting on behalf of a user (the Bale bot) pass ``X-Actor-Id``
+    (users.id); it wins over the raw token so the audit trail shows the human.
     """
+    actor_id = request.headers.get("X-Actor-Id")
+    if actor_id:
+        return actor_id.strip()
     auth = request.headers.get("Authorization")
     if auth and auth.lower().startswith("bearer "):
         return auth[7:].strip() or None