Tagged “identity”
- An agent's token should name two parties: the person and the agent
When an agent calls an API for someone, the token usually names one party: the agent's service account or the person it is acting for. OAuth Token Exchange has a way to name both. Here is what that looks like on the wire, what MCP already requires, and where it stops helping.