This OID identifies the actual identity on whose behalf this policy request was made, which can differ from the requestor itself when the request was proxied. This matters when policy changes cascade through inherited templates, letting an admin trace a resolution request back to the original object that ultimately needs the policy, not just the immediate object that issued the call. A profile created from a service-profile template might show the template as onBehalfOfIdent even though the individual profile is the direct Requestor.