On-behalf-of identity is the pattern where one actor performs an action for another actor while both identities remain visible to downstream systems. In agent governance, it lets organisations preserve the human principal, the executing agent, and the scope of authority in the same control and audit model.
What the pattern means in practice
On-behalf-of identity is not just delegation in the abstract. It is a way to preserve the human principal, the acting agent, and the authority being exercised so downstream systems can distinguish who requested an action from what actually executed it.
That distinction matters because audit, policy, and incident review all become ambiguous when an automated component or intermediary hides the original requester. The pattern keeps attribution visible without collapsing everything into a single shared actor.
Why it matters for delegated authority
The core value of the pattern is that authority remains bounded. A downstream system can see that an action was executed by an agent or service, but under the authority of a different principal, which makes approvals, consent, and scope easier to reason about.
In agentic workflows, that separation is especially important when the same execution path can be used for different users or tasks. RFC 8693: OAuth 2.0 Token Exchange is the standard reference for token exchange flows that support delegation and impersonation, which is the technical backbone of many on-behalf-of designs.
How it shows up in systems and logs
Well-designed implementations preserve at least three things: the original subject, the intermediate actor, and the effective scope. That may appear in token claims, audit events, request headers, or authorization context, depending on the platform.
When done well, the same event trail can answer different operational questions: who initiated the action, which component executed it, and what permissions were in force at the time. That is far more useful than a flat log that only names the last hop.
In environments with AI agents or mixed human and machine workflows, Agentic AI Identity Guide is a useful companion for understanding how delegated authority, registration, and retirement fit into the broader identity model.
Where the pattern breaks down
On-behalf-of identity becomes fragile when systems treat delegation as a simple pass-through. If the original principal is dropped, over-broadened, or inferred later from unrelated metadata, the model stops being trustworthy and becomes hard to audit.
It also breaks down when organisations mix shared credentials, hidden service accounts, or informal forwarding patterns into the same path. At that point, the system may still function, but the identity story is no longer reliable enough for control or accountability.
For a wider view of how human and machine access meet, Human vs Non-Human Identity helps explain why these boundary cases are so often misunderstood, especially where users, agents, and service identities overlap.
Risk and Threat Considerations
On-behalf-of identity creates risk when the system cannot prove who initiated the action, who executed it, and what authority was actually delegated. That uncertainty can weaken auditability, hide overreach, and make malicious or accidental misuse harder to detect.
Failure mechanism: An attacker or careless operator abuses a delegated flow, strips the original principal from the record, or stretches the delegated scope beyond what was intended, so the downstream system accepts an action that appears legitimate but is not properly attributable.
Impact: The result can be unauthorized actions, misleading logs, harder incident reconstruction, and weaker containment because responders cannot quickly determine which principal, token, or agent path was abused.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | Delegated agent actions can blur who is acting under whose authority. |
| Recommendation — Preserve original principal context so agent actions cannot silently inherit broader privilege. | ||
| NIST SP 800-53 Rev 5 | AU-3 — Content of Audit Records | On-behalf-of flows depend on audit records that show requester, actor, and scope. |
| IA-9 — Service Identification and Authentication | Delegated machine or service execution often relies on authenticated non-human actors. | |
| Recommendation — Record the initiating principal, acting component, and delegated authority in each audit event. Authenticate the executing service or agent separately from the human principal. | ||
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | On-behalf-of designs often use token exchange or delegated authentication paths. |
| Recommendation — Validate delegated authentication flows so impersonation cannot be accepted as direct identity. | ||
Practitioner Guidance
Why practitioners should care: The pattern only works when attribution survives the full request path. If the human principal, acting identity, and delegated scope are not all visible where decisions are made, the control model is weaker than it looks.
What to watch for: Watch for systems that collapse all delegated activity into a single service identity, or that preserve the actor but not the original requester. Those designs usually create audit gaps and make access reviews less meaningful.
Practitioner takeaway: Treat on-behalf-of identity as an attribution and authority design problem, not just an authentication detail.
Related resources from NHI Mgmt Group
- Where do identity programmes fail when actions can be taken on behalf of a user?
- How should security teams handle identity in MCP servers that call backend tools on behalf of users?
- How should security teams implement delegated authorization for on-behalf-of access in applications and identity flows?
- How should organisations design identity for AI agents that act on behalf of users across many services?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 1, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org