Delegated Authorization
Delegated Authorization is an authorization mechanism within the OAuth 2.0 framework (RFC 8693) that allows an authenticated principal to delegate a subset of its permissions to another entity, such as an AI agent. The resulting token retains information about the authorization chain's origin, supporting traceability of delegation relationships and serving as a foundation for security auditing in AI workflows.
Timeline (last 90 days)
In multi-tenant agent systems, credential isolation is typically implemented through three approaches: delegated authorization, service accounts with scope mapping, and credential vaults.
The runtime cannot authorize itself; before execution, the integrating application establishes a delegation bound to a specific execution, runtime identity, action, resource, and expiration time, and the authorization service validates and persists that delegation.
The delegated authorization mechanism has two mutually independent controls: whether the issuer has the right to delegate that action, and whether the runtime's proposed operation conforms to the policy and the scope of the delegation.
All Facts (3)
In multi-tenant agent systems, credential isolation is typically implemented through three approaches: delegated authorization, service accounts with scope mapping, and credential vaults.
50%UnverifiedThe runtime cannot authorize itself; before execution, the integrating application establishes a delegation bound to a specific execution, runtime identity, action, resource, and expiration time, and the authorization service validates and persists that delegation.
50%UnverifiedThe delegated authorization mechanism has two mutually independent controls: whether the issuer has the right to delegate that action, and whether the runtime's proposed operation conforms to the policy and the scope of the delegation.
50%