Agents - Tag - Lorenzo's Bloghttps://www.k8s.it/tags/agents/Agents - Tag - Lorenzo's BlogHugo -- gohugo.ioenSat, 18 Jul 2026 00:00:00 +0000Who Is Your AI Agent Acting For? RFC 8693 On-Behalf-Of Delegationhttps://www.k8s.it/posts/who-is-your-ai-agent-acting-for-rfc-8693-on-behalf-of-delegation/Sat, 18 Jul 2026 00:00:00 +0000Lorenzo Girardihttps://www.k8s.it/posts/who-is-your-ai-agent-acting-for-rfc-8693-on-behalf-of-delegation/

Table of Contents

  • Introduction
  • The Problem: agents are anonymous proxies
  • Enter RFC 8693: Token Exchange, On-Behalf-Of
  • The Architecture
  • The Identity Flow, Step by Step
  • Token Anatomy
  • Where Authorization Actually Happens
  • Observability: Watching Delegation Happen
  • Security Properties
  • Conclusion
  • Reflections

Here we are. Everyone is wiring AI agents to real systems — Kubernetes clusters, CI pipelines, internal APIs — and almost nobody is asking the boring question first: when the agent calls a tool, who is it?

]]>