Skip to content
Agent Identity

Flow · multi-hop

Multi-hop on-behalf-of (Token Exchange + chaining)

The user authorizes Agent A. A calls Service B. B must call API C in another domain without pretending to be the user or widening scope.

Actors

User · Agent A · AS A · AS B · API C

Sequence

  1. 1

    User→AS A

    Delegates to Agent A (OAuth 2.1 / OIDC)

  2. 2

    Agent A→AS A

    Token exchange: subject = user token, actor = agent, attenuated scope, aud toward B

    RFC 8693 act claim records the agent

  3. 3

    Agent A→AS A

    If crossing domains: exchange for a JWT grant aud=AS B (identity chaining)

  4. 4

    Agent A→AS B

    RFC 7523 JWT bearer grant → access token for API C

  5. 5

    Agent A→API C

    Present audience-restricted, preferably PoP-bound token

Caveats

Never expand scopes at a hop. Inside one domain, transaction tokens carry immutable purpose. Across domains, identity chaining is in the RFC Editor queue — still cite the draft until an RFC number exists.

Specs in play