The biggest architectural risk in enterprise AI today isn’t prompt injection—it’s Delegation Escalation.
When a human user triggers an AI Agent Orchestrator, which then delegates tasks to sub-agents and tool execution gateways via MCP or internal APIs, traditional static service accounts break down.
If you pass broad bearer tokens or static user API keys down the execution chain, you create a massive Confused Deputy vulnerability. To deploy autonomous multi-agent chains safely at enterprise scale, platform architects must enforce OAuth 2.1 RFC 8693 Token Exchange with explicit actor claims.
read:finance
) to the primary Agent Orchestrator.act
) identifying both the human subject and the orchestrator, ensuring execution authority is strictly bounded by the intersection of their permissions.Delegation Over Impersonation (RFC 8693): Never allow an agent to blindly impersonate a user. Enforce OAuth 2.1 Token Exchange so every issued JWT token contains a nested actor claim: Human Subject -> Agent Orchestrator -> Sub-Agent
. Every downstream API must verify both who authorized the action and which agent executed it.
Intersection of Privileges (User ∩ Agent): An agent’s runtime authority must be the strict mathematical intersection of the user’s IAM permissions and the agent’s registered tool scope. An agent should never acquire more system access than the human user who invoked it.
Ephemeral Tokens & DPoP Binding: Eliminate static configuration API keys and long-lived refresh tokens. Issue short-lived tokens (5-minute TTL) cryptographically bound via DPoP (RFC 9449) or mTLS so intercepted tokens cannot be replayed across service boundaries.
Stop treating AI agents as traditional service accounts or background jobs. Non-human identities outnumber human users 17-to-1 in modern cloud environments. If your Identity Provider (IdP) cannot audit nested delegation chains at runtime, your agentic architecture is an unmonitored security breach waiting to happen.
How is your platform team handling OAuth token delegation and non-human identity in your multi-agent workflows?
I'm an Enterprise Cloud & AI Architect with 14 years of experience in the IT industry, helping organizations design and scale enterprise-grade cloud, AI, and automation solutions.
My current work focuses on building enterprise-scale AIOps platforms, accelerating customers' AI-first transformation journeys, driving FinOps adoption, and developing production-ready Generative AI applications that create measurable business impact.
Feel free to connect with me on LinkedIn or X (Twitter) @jitu028. For 1:1 architecture guidance, visit my Topmate.