Tag: Delegation

Delegation and impersonation explained: OAuth 2.0 Token Exchange and the act claim, and why AI agents acting as users need true delegation, not shared identity.

• Why We Only Catch "Rogue" AI Agents by Accident

  12 Aug, 2026

  • 14 min read

  Three frontier labs disclosed that their AI agents breached real companies. None were caught in real time. The problem is not model behavior—it is that the agent is using your identity.

• OAuth 2.0 Token Exchange (RFC 8693) in Practice

  26 Sep, 2023

  • 14 min read

  Practical OAuth 2.0 Token Exchange (RFC 8693): impersonation vs delegation, the act claim, scope down-scoping, cross-domain and workload identity use cases.