ConceptToken Exchange / RFC 8693
RFC 8693 Token Exchange
An OAuth 2.0 extension protocol defined by the IETF for exchanging tokens between trusted identity providers, enabling a subject to call downstream services under the identity of another subject or a downgraded role without exposing the original credentials.
Timeline (last 90 days)
Oct 15
The Agent runtime has no network, no keys of its own, and cannot directly call backend systems, and can only make requests to the doors; when it needs to operate on a system isolated per user, the gateway performs an RFC 8693 Token Exchange, exchanging the initiator's verified Token for a Token that acts on the upstream, and then calls the system as the initiator, with keys never entering the Agent process.
Unverified50%