Comparing user applications to other resources. Detecting user activity

Cluster information:

Kubernetes version: v1.24.1
Host OS: macOS

Hey there,

As part of my research, I am examining how a real user makes any change or uses other resources, such as argo, aks, gatekeeper.
I created a validation webhook admission controller listener that keeps track of all cluster apply’s
There is a lot of data I am receiving that I am not really sure how to categorize.

It is important to determine who made the changes, a real human or some other resources that I mentioned previously

Any Idea?