Free tools Windows power users keep installed
One-click scans. No signup required.
Delegated authorization lets an AI agent use specific authority granted by a user or another principal without making the agent indistinguishable from that principal. The principal and the agent remain separate identities: one is represented by the request, and the other is the actor carrying it out. OAuth 2.0 Token Exchange (RFC 8693) provides a standardized building block for this pattern, but it is not a complete, universal authorization architecture for AI agents.
What delegated authorization means
In delegated authorization, a principal—often a user—allows an agent to act within some granted authority. The agent can request access to a tool or API on the principal’s behalf, while the authorization system retains information about both the principal and the agent.
![Claude AI for Beginners Bible: [5 in 1] The Ultimate Guide to Automate Your Work, Save Hours Every Week, and Use AI for Real-World Results](https://m.media-amazon.com/images/I/415+fSJacsL._SL160_.jpg)
As an Amazon Associate I earn from qualifying purchases.
RFC 8693 describes the distinction this way: “With delegation semantics, principal A still has its own identity separate from B, and it is explicitly understood that while B may have delegated some of its rights to A, any actions taken are being taken by A representing B.” The practical consequence is that a service can make policy decisions and record activity with both identities in view, rather than attributing every action solely to the user.
Recommended Free Tools
How an authorization flow works
OAuth 2.0 Token Exchange defines a mechanism for requesting a token from an authorization server in exchange for another token. In a delegated flow, the agent client presents a token representing the principal and identifies the agent as the actor. The authorization server applies its policy and may issue a token suitable for a particular API or service. That resource server then validates the token and enforces the permissions it conveys.
#1 Best Overall
- The principal grants access. The user or other principal authorizes an agent to request access within the applicable consent and policy rules.
- The agent authenticates as itself. The client representing the agent identifies itself to the authorization server. Client authentication gives the server another basis for deciding whether this client may request delegated access.
- The agent requests an exchanged token. In RFC 8693 terms, the
subject_tokenrepresents the party on whose behalf access is requested, while theactor_tokenrepresents the party receiving delegated rights. The exchange can also identify the intended destination resource. - The authorization server evaluates the request. It decides whether to issue a token and what its contents and permissions should be. A request does not guarantee that a token will be issued.
- The target service enforces access. The API or service validates the resulting token and applies its own authorization checks to the requested action.
RFC 8693’s optional resource parameter identifies the intended target resource and can help the authorization server apply target-specific policy. It is not a universal guarantee that a token will be limited to one API; that depends on the server’s implementation and policy.
Delegation is not impersonation
These terms describe different identity semantics, not interchangeable names for the same token flow.
| Model | Identity presented downstream | What it means for attribution |
|---|---|---|
| Delegation | The principal and the acting agent can remain separately identifiable. | A downstream system can attribute an action to the agent acting for the principal, if the token and system preserve that context. |
| Impersonation | The requested token can represent the principal as the effective identity. | The actor may not remain separately visible in the effective identity, which can change what downstream policy and audit records can establish. |
RFC 8693 supports both semantics. A JWT act claim can represent an actor and can express a chain of delegation. Whether an authorization server issues a composite token—and exactly how it represents subject and actor—is implementation- and policy-dependent.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteWhat the standards do—and do not—settle
| Document | Status and date | Relevance to agent authorization |
|---|---|---|
| OAuth 2.0 Token Exchange, RFC 8693 | IETF Standards Track specification, January 2020. | Defines a token-exchange mechanism and parameters that can express delegation or impersonation. It does not prescribe a complete trust model or settle all token-security characteristics. |
| OAuth 2.0 Security Best Current Practice, RFC 9700 | IETF Best Current Practice, January 2025. | Provides OAuth security guidance, including risks from access-token leakage and replay. |
| NIST NCCoE concept paper, “Accelerating the Adoption of Software and AI Agent Identity and Authorization” | Concept paper, February 2026. | Frames agent identity and authorization around topics including OAuth extensions and policy-based access control. It is not a protocol standard. |
| “OAuth on-behalf-of-user authorization for AI agents” Internet-Draft | IETF Internet-Draft; a proposal, not a finalized RFC. | Proposes an OAuth extension and describes the agent as a distinct identity in an exchange process. |
| “Agent Authorization Profile (AAP) for OAuth 2.0” Internet-Draft | IETF Internet-Draft; a proposal, not a finalized RFC. | Describes a profile drawing on existing OAuth, JWT, token-exchange, and proof-of-possession mechanisms for agent-to-API scenarios. |
For an implementation, RFC 8693 is the established protocol building block; the agent-specific documents above are proposals, not evidence of a universally adopted profile. Token exchange alone does not specify which parties should trust one another, the exact claims a token must contain, how tokens are bound to a client, how long they last, or how revocation should work. Those decisions belong to deployment policy and any profile being used.
What to protect when implementing delegation
- Keep the agent’s identity distinct. Give the agent client its own authenticated identity and avoid turning a user’s password or other credential into a shared, long-lived agent secret.
- Constrain access to the intended resource. Request a token for the destination service and let authorization policy determine the permitted scope. Do not assume a token issued for one API is safe to reuse with another.
- Authenticate the exchanging client. Set policy for which clients may request delegated tokens. RFC 8693 warns that, without client authentication, someone who obtains a compromised token may be able to exchange it.
- Reduce leakage and replay risk. Apply the OAuth security guidance in RFC 9700. As an implementation practice, treat bearer tokens as credentials: do not expose them in prompts, model context, logs, or to untrusted tools.
- Define lifecycle rules explicitly. Decide how consent changes, expiry, revocation, and delegation-chain limits affect access. Token exchange does not make revocation immediate or automatic.
- Preserve useful audit context across hops. When authority passes through multiple services or agents, retain enough information to identify the principal, the current actor, the target resource, and the policy decision. RFC 8693 supplies the subject-and-actor model; it does not guarantee that every downstream system will preserve or enforce it.
- Account for unsafe tool use. Prompts and tool outputs can influence an agent to use its authority in unintended ways. Treating them as untrusted inputs is a broader implementation safeguard, not an agent-specific threat model defined by the OAuth standards cited here.
How to assess an implementation
When comparing a profile or system, check whether it makes the following behaviors explicit rather than inferring them from the phrase “agent authorization”:
- Whether the principal and agent remain distinguishable to the authorization server and downstream services.
- How the target resource and allowed actions are bounded.
- Whether each service in a multi-hop chain retains delegation context.
- How token lifetime, consent changes, and revocation affect an already-issued token.
- What client authentication and proof-of-possession mechanisms are supported.
- Whether audit records can attribute an action to both the principal and responsible agent.
- Whether the approach relies on a published standard, an Internet-Draft proposal, or implementation-specific behavior.
For systems using MCP, NIST’s February 2026 concept paper says MCP relies on existing identity standards such as OAuth and OpenID Connect for authentication and rights delegation. That does not mean MCP itself supplies every authorization policy or resolves delegation across every tool chain.
Quick Recap
Best Value
Rank #4
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
