Notifications
Clear all
Topic starter
14/08/2026 6:37 pm
TL;DR: AI agents have turned on-behalf-of identity into the central delegated access problem, and RFC 8693 token exchange is emerging as the common protocol for preserving actor, subject, scope, and audit trail across multi-hop requests, according to Oleria Security. The real shift is that legacy identity assumptions about one user, one session, and one audit row no longer hold when actions fan out at machine speed.
NHIMG editorial — based on content published by Oleria Security: On-behalf-of identity at machine speed
Questions worth separating out
Q: How should security teams govern AI agents that can access enterprise systems?
A: Security teams should govern AI agents as non-human identities with explicit ownership, scoped privileges, and continuous monitoring.
Q: Why do AI agents complicate existing IAM and PAM controls?
A: AI agents complicate IAM and PAM because they often inherit delegated credentials, operate across multiple systems, and keep acting after the initial approval moment has passed.
Q: What breaks when AI agent permissions are inherited from the host application?
A: The boundary between application access and agent access disappears.
Practitioner guidance
- Map every agentic workflow to a delegation chain Document the human principal, intermediate agent, gateway, and downstream service for each task path so you can see where authority changes hands.
- Require token exchange at each trust boundary Where OAuth is available, require RFC 8693 conformant exchange with explicit actor and subject claims and audience-bound scopes.
- Classify long-lived agent credentials as high-risk delegated access Inventory OAuth tokens, API keys, session cookies, and vendor SDK credentials used by agents, then identify where broad scopes persist beyond the immediate call boundary.
What's in the full article
Oleria Security's full article covers the protocol detail this post intentionally leaves for the source:
- The RFC 8693 token exchange mechanics, including the act and may_act claims, in the context of AI agent delegation.
- The MCP and enterprise gateway design patterns that translate non-OAuth agent workloads into on-behalf-of semantics.
- The platform-by-platform examples cited by the vendor, including AWS AgentCore Identity and the Coalition for Secure AI guidance.
- The specific implementation questions the article uses to test whether an agent platform can preserve auditability across hops.
👉 Read Oleria Security's analysis of on-behalf-of identity at machine speed →
RFC 8693 and AI agent delegation: what changes for IAM teams?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
14/08/2026 6:43 pm
Delegated access has become the primary identity boundary for AI agents. The old model assumed a human authenticated once and then the system simply enforced session permissions. AI agents break that assumption because the meaningful decision sits at each hop, not at login. The practical conclusion is that delegated authority now belongs in identity governance, not in application-specific plumbing.
A few things that frame the scale:
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
- Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared with nearly 1 in 4 for securing human identities.
A question worth separating out:
Q: Who is accountable when an AI agent runs a query on behalf of a user?
A: Accountability sits with the identity chain, not with the tool call alone. The human who delegated the action, the issuer that minted the token, and the platform that activated the role all need a traceable record. If any of those links are missing, the organisation cannot prove who authorised the access.
👉 Read our full editorial: On-behalf-of identity at machine speed needs token exchange
