Topic starter
14/08/2026 6:37 pm
TL;DR: AI agents have turned on-behalf-of identity into the central delegated access problem, and RFC 8693 token exchange is emerging as the common protocol for preserving actor, subject, scope, and audit trail across multi-hop requests, according to Oleria Security. The real shift is that legacy identity assumptions about one user, one session, and one audit row no longer hold when actions fan out at machine speed.
Editorial analysis by NHI Mgmt Group, based on content published by Oleria Security: “On-behalf-of identity at machine speed: what AI agents change about delegated access”.
Key questions
Q: How should security teams govern AI agents that browse and transact on behalf of users?
A: Security teams should govern AI agents as delegated actors with narrow, task-scoped permissions, not as enhanced browsers.
Q: Why do AI agents make delegated access riskier than traditional service-to-service calls?
A: AI agents increase risk because one human request can fan out into many downstream actions, often across several systems and other agents.
Q: What breaks when credentials outlive a short-lived AI task?
A: When credentials outlive a short-lived task, the unused window becomes an exposure window.
Practitioner guidance
- Inventory delegated access paths Map where AI agents, copilots, workflow tools, and services currently inherit user authority instead of exchanging it for scoped tokens.
- Require actor-preserving token exchange Make RFC 8693-style token exchange the default pattern for hops that cross trust boundaries, with the original subject and acting agent both preserved in the token.
- Separate user intent from execution identity Ensure policy can distinguish the human authorising an action from the agent executing it, especially where the agent calls other services on the user's behalf.
Bottom line: AI agents expose a delegated access problem that legacy one-user, one-session identity models cannot describe cleanly.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/08/2026 6:43 pm
RFC 8693 is no longer a niche backend protocol; it is the default delegation primitive for AI agents. The article shows convergence across platform, infrastructure, and enterprise guidance because the same identity problem keeps reappearing at different layers. That convergence matters because it narrows the design space for practitioners and makes token exchange the reference point for delegated access governance.
A few things that frame the scale:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
- 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What is the difference between user identity and actor identity in agent delegation?
A: User identity identifies whose intent the action represents, while actor identity identifies what actually executed the call. In delegated agent workflows, both are needed at once so downstream systems can enforce policy, preserve auditability, and avoid collapsing a human decision into an opaque machine action.
👉 Read our full editorial: On-behalf-of identity at machine speed needs token exchange