How does token exchange reduce blast radius?

By replacing one long-lived broad token with many short-lived narrow ones minted per action. The agent never holds a token more powerful than the current step needs, and each token is bound to a specific audience so it can't be replayed elsewhere. Combined with Delegated Authority (On-Behalf-Of), the result is that a compromised agent's reachable scope collapses to whatever it happened to be doing at the moment of compromise.

OAuth Token Exchange (RFC 8693)

Written by Max Zeshut

Founder at Agentmelt

An OAuth 2.0 extension that lets a party trade one token for another — used in agent identity to implement Delegated Authority (On-Behalf-Of) and just-in-time privilege narrowing. Two capabilities matter for agents. First, delegation: the exchanged token can carry the user as `sub` and the agent as a nested `act` (actor) claim, so downstream services see both identities instead of the agent impersonating the user. Second, scope reduction: an agent holding a broad base token can exchange it, immediately before a sensitive call, for a narrowly-scoped, audience-restricted, short-lived token — so a compromised agent can only replay tokens for the exact resource it was mid-task on, not its entire accumulated access. RFC 8693 is a stable standard; the OpenID Foundation and the March 2026 IETF agent-auth draft both build their delegation model on it.

Пример

A data agent holds a base token scoped to 'analytics.read'. Before exporting one report it exchanges that token for an ephemeral token bound to `audience=warehouse.reports`, scoped to a single dataset, expiring in 5 minutes. If the agent is hijacked 20 minutes later, that token is already dead and can't be replayed against any other warehouse resource.

Часто задаваемые вопросы

How does token exchange reduce blast radius?: By replacing one long-lived broad token with many short-lived narrow ones minted per action. The agent never holds a token more powerful than the current step needs, and each token is bound to a specific audience so it can't be replayed elsewhere. Combined with Delegated Authority (On-Behalf-Of), the result is that a compromised agent's reachable scope collapses to whatever it happened to be doing at the moment of compromise.

Связанные ниши

Назад в глоссарий

Loading…