Letting AI agents act for users: the RFC 8693 token exchange

Описание и применение

Брокер ping-entra-broker реализует RFC 8693, позволяя ИИ‑агентам действовать от имени пользователя, выдавая токен с ограниченными правами и предотвращая раскрытие пользовательских токенов.

Задача

When an AI agent calls Microsoft Graph, it must act on behalf of a user while preserving auditability and preventing misuse of user credentials.

Результат

The broker enables agents to act on behalf of users without exposing user credentials, enforces fine‑grained resource access, and prevents replay attacks.

Рабочий процесс

• 1. User authenticates to PF. 2. Agent requests token exchange from broker with subject_token (PF token), actor_token (agent JWT), client_assertion, resource, and scope. 3. Broker validates tokens, checks resource map, enforces allowed scopes, delivery mode, and hop limits. 4. Broker returns an Entra access token to the agent. 5. Agent calls downstream API using the issued token.

Доказательства

The broker issues an agent a token that names both the user it acts for and the agent doing the work, and it limits that token to the one resource the agent asked for.

Источник

The broker verifies the assertion's audience, so one captured assertion cannot be used at another service.

Источник

The broker performs the exchange and returns a response of this shape.

Источник