Letting AI agents act for users: the RFC 8693 token exchange

说明与用途

ping‑entra‑broker 实现 RFC 8693，允许 AI 代理代表用户行动，发放受限令牌并防止用户凭据泄露。

问题

When an AI agent calls Microsoft Graph, it must act on behalf of a user while preserving auditability and preventing misuse of user credentials.

结果

The broker enables agents to act on behalf of users without exposing user credentials, enforces fine‑grained resource access, and prevents replay attacks.

工作流

• 1. User authenticates to PF. 2. Agent requests token exchange from broker with subject_token (PF token), actor_token (agent JWT), client_assertion, resource, and scope. 3. Broker validates tokens, checks resource map, enforces allowed scopes, delivery mode, and hop limits. 4. Broker returns an Entra access token to the agent. 5. Agent calls downstream API using the issued token.

证据

The broker issues an agent a token that names both the user it acts for and the agent doing the work, and it limits that token to the one resource the agent asked for.

来源

The broker verifies the assertion's audience, so one captured assertion cannot be used at another service.

来源

The broker performs the exchange and returns a response of this shape.

来源