Letting AI agents act for users: the RFC 8693 token exchange

Description and use

The ping‑entra‑broker implements RFC 8693, enabling AI agents to act on behalf of users by issuing a limited token and preventing exposure of user credentials.

Problem

When an AI agent calls Microsoft Graph, it must act on behalf of a user while preserving auditability and preventing misuse of user credentials.

Outcome

The broker enables agents to act on behalf of users without exposing user credentials, enforces fine‑grained resource access, and prevents replay attacks.

Workflow

• 1. User authenticates to PF. 2. Agent requests token exchange from broker with subject_token (PF token), actor_token (agent JWT), client_assertion, resource, and scope. 3. Broker validates tokens, checks resource map, enforces allowed scopes, delivery mode, and hop limits. 4. Broker returns an Entra access token to the agent. 5. Agent calls downstream API using the issued token.

Evidence

The broker issues an agent a token that names both the user it acts for and the agent doing the work, and it limits that token to the one resource the agent asked for.

Source

The broker verifies the assertion's audience, so one captured assertion cannot be used at another service.

Source

The broker performs the exchange and returns a response of this shape.

Source