If the Web activity expects an XML response document or the called process is allowed to send a notification, you can define an authentication here.

The target system has to use a valid user password combination when sending the XML response document or the notification so that the SAP system accepts the XML message. To ensure that the XML response document is also determined for this Web activity, you can define permitted users. The Web activity only processes the content of the XML message when logon of the XML message to the SAP system is made using the name of a permitted user. The permitted agents are derived from the intersection of the users entered on this tab page and the possible agents of the reference workflow.

Here define both the possible agent of the reference workflow and also the responsible agent. If you classify the reference workflow as a General task, the users entered here have user names with which a valid logon can take place.