Auth Broker
agent builders will need this, and we will need an answer
Agents that call tools on behalf of a person need delegated, scoped, expiring authority that names the principal, the agent and the task; OAuth scopes cannot express that triple, so every agent we ship into a regulated client needs a broker in front of its tool calls.
Experiment run, measured result. The only tier that becomes a recommendation.
Confidence
68%human-committedExpiry
22duntil review · 25 Sep 2026Lead time
—not yet mainstream · opened 12 Jan 2026Ownership
TOTom Okaforfortnightly cadenceWhere it is
Every agent pattern we have delivered this year runs under a service account with a role wide enough to finish the task, which means wide enough to do damage. The identity vendors noticed in Q2 and two of them shipped 'agent identity' previews in August; an IETF draft for on-behalf-of token exchange is the shape they are converging on. Our own proof of concept put a policy engine at the tool-call boundary and blocked over-privileged calls at under 15 ms overhead. The hard part turned out to be writing the policies, not evaluating them, and nobody on a delivery team is staffed to do it.
Why a Quantium decision hinges on it
Banking and government clients now ask, in the first workshop, whose credentials the agent is using when it acts. We have not had a good answer. APRA is treating agents as non-human identities under CPS 234 rather than writing new rules, which makes audit trail the binding requirement on every agent we put near a payment or a customer record. A reusable broker pattern is the difference between agent work in regulated sectors and agent demos in regulated sectors.
Field attributes
Position
What is demonstrated, what is hype, what would have to be true.
The shape every position request answers. Signal-tier fields carry a draft; assessed and tested fields carry a validated one.
- 01A policy engine evaluated at the tool-call boundary blocked 11 of 214 calls in a servicing-agent replay, all 11 correctly, at 12 ms p50 overhead (x-auth-broker-poc).
- 02On-behalf-of tokens carrying principal, agent and task id give a usable audit trail: every tool call in the replay reconciles to a person and a case.
- 03The pattern is harness-agnostic. The same broker sat in front of Claude Code, a LangGraph loop and a bespoke Python agent through one sidecar.
- 01'Agent identity' as a product category. What shipped in August is a token format and a console; the policy layer is still the client's problem.
- 02Scoped tokens as a prompt-injection defence. A scoped token limits blast radius; it does nothing about an agent being talked into a legitimate but wrong call.
- 03Zero-trust vendors relabelling service-mesh auth as agent auth. Workload identity is necessary and does not name the human.
- 01A policy authoring workflow that a delivery engineer can run without a security engineer — the step that took 60% of the PoC effort.
- 02The on-behalf-of draft stabilising enough that identity vendors implement it the same way; two previews already disagree on where the task id lives.
- 03Client identity platforms (Entra, Okta, Ping in the AU banks we serve) exposing the token exchange, not just the console.
- 01Ship r-auth-broker as the delivery default for any agent with write access to a system of record.
- 02Run a Type 3 on policy authoring: can Cedar-style templates cover 80% of servicing-agent tool calls without hand-written rules.
- 03Track the two vendor previews to GA and re-baseline the position if they converge on the draft.
Signals · 10 in this cluster
What the cluster is made of.
Every item carries its source, tier and sightings. Detector-found signal sits beside human drops; downstream they are indistinguishable except by provenance.
Broker PoC: policy engine at the tool-call boundary blocks 11 of 214 calls at 12 ms
Replayed a banking servicing agent's tool calls through a sidecar broker issuing on-behalf-of tokens per case. Eleven calls exceeded the delegated scope and were blocked; all eleven were correct blocks. Latency overhead 12 ms p50, 31 ms p99. Policy authoring took 60% of the effort.
extracted claimA tool-call policy engine is cheap to run and expensive to author.
Two identity vendors ship 'agent identity' previews in the same month
Both issue short-lived tokens naming an agent and an acting user. Neither ships a policy layer; both leave 'what may this agent do for this task' to the customer. Naming event: 'non-human identity' became the shared term.
extracted claimIdentity vendors will ship the token format first and leave policy to the customer.
Frontier lab hiring 'Agent Identity & Delegation' engineers ×3
Three openings referencing token exchange, delegation chains and 'acting-party semantics'. Argus inference: a first-party delegation primitive is coming in the lab's agent platform. Carried as inference.
APRA industry letter: non-human identities are in scope for CPS 234 control testing
Letter to ADIs and insurers clarifying that automated agents acting on systems of record are 'information assets' with identities that must be tested under CPS 234. No new standard; existing controls apply. Audit trail is explicitly named.
'The confused deputy is back, and it has a system prompt'
Demand-band signal. The confused-deputy framing for agent authorisation appeared in five talks at the event. Cross-band ignition with the vendor previews two months later.
IETF draft: On-Behalf-Of Token Exchange for Agentic Clients
Extends RFC 8693 token exchange with a task identifier and an agent identifier alongside the acting party. Two identity vendors cite it in their August previews, but disagree on whether the task id is a claim or a separate token.
extracted claimOn-behalf-of token exchange with a task id is the shape the industry will converge on.
agentgate — Cedar-policy sidecar for agent tool-call authorisation
Open-source sidecar that evaluates a Cedar policy per tool call with the on-behalf-of token as principal. We used it as the PoC's policy engine. Template library is thin; most policies are hand-written.
Logged from Claude Code: service-account agent read 3 customer records it had no reason to touch
Product engineer logged from a session: tightening the IAM role on a test agent did not stop it reading adjacent customer records, because the task needed the same table. Swapping to a per-case token blocked the reads. Tried tier, one harness, decays fast.
'Whose credentials is the agent using when it moves the money?'
Asked by a bank's CISO in the first design workshop for a servicing agent. Delivery had no answer beyond 'a service account'. Logged unanswered; became the replay corpus for the PoC. This is the demand signal that elected the field.
'OAuth scopes were designed for apps, not agents'
Argues a scope names what an app may touch, never on whose behalf or for what task, and that agents break the assumption that the app's intent is fixed at consent time. Cited in the IETF draft's introduction.
Claims · 4 supporting, 1 refuting
The atoms.
A document cannot go stale; an assertion can. Claims are immutable and stamped with the extractor that produced them, so staleness, diffs and the graveyard operate at claim level.
OAuth scopes cannot express task-bounded delegation: a scope names a resource class, not a principal–agent–task triple, so any scope broad enough for the task is broad enough for misuse.
A policy engine at the tool-call boundary adds under 15 ms p50; the cost of the pattern is in policy authoring, not latency.
Regulators will treat agents as non-human identities under existing control frameworks rather than write new rules, which makes audit trail — not token format — the binding requirement.
Identity vendors will ship agent-identity primitives before a standard settles, and the on-behalf-of token exchange draft will be the de facto shape.
Existing service-account patterns with tighter IAM roles are sufficient for agent delegation in regulated environments.
Position history · the diff is the product
4 validation runs against a fixed brief. Confidence 40% → 68%.
PoC concluded: the pattern works at negligible latency and the cost is policy authoring. Two vendor previews shipped mid-run. Recommendation published; policy tooling is the next gate.
- A policy engine at the tool-call boundary adds under 15 ms p50; the cost of the pattern is in policy authoring, not latency.
- Identity vendors will ship agent-identity primitives before a standard settles, and the on-behalf-of token exchange draft will be the de facto shape.
- c-auth-broker-1 ↑ 0.7 → 0.82
Scoring · ordinal bands
Agents propose. A named human commits.
Uncommitted scores are visibly marked and never leave the building. Bands, not point estimates — false precision is the tell that a number was generated rather than derived.
Impact
committed · AWEvery agent with write access in banking, insurance or government passes through this.
Timeline
committed · TOVendor previews already shipped; clients are asking now.
TAM
agent-estimatedAgent-estimated from identity-platform spend and non-human-identity vendor funding. Uncommitted.
Cost
committed · TOOne engineer for the broker; a second for policy authoring per engagement until templates exist.
Cost of being wrong
committed · LFAn over-privileged agent in a bank is a reportable incident, not a bug.
Demand
committed · CDRaised unprompted in three banking workshops this half. One RFP names 'agent identity' as a mandatory control.
Workforce readiness
agent-estimatedNo delivery team has written a tool-call policy. Agent-estimated.
Relevance · per vertical
Why it matters here, or explicitly does not.
Ranking is per vertical, not global. Sector owners commit notes against agent drafts.
Any agent that initiates a payment, updates a customer record or reads across accounts needs to act as a named person with a bounded task. CPS 234 control testing now includes non-human identities.
Mechanism · Broker issues on-behalf-of tokens per case; policy engine gates writes; token log is the CPS 234 evidence.
Agencies already have delegation models for humans (authorised officers). Agents need the same thing, expressed in tokens.
Mechanism · Map existing delegation instruments to policy templates; audit trail satisfies record-keeping obligations.
Claims agents that can approve, reserve or pay must act under the assessor's authority and inside the assessor's limits.
Mechanism · Task-scoped token carries the assessor's delegation limit; policy engine enforces it per call.
Retail agents mostly read. The broker matters once they write to pricing or supplier systems, which no engagement has asked for yet.
Mechanism · Would apply to promotion-setting or supplier-order agents if those are built.
Red team · the strongest case against
The strongest case against: this is an identity-platform feature, and the identity platforms the clients already own will ship it within twelve months. Building a broker is building the thing Microsoft and Okta will give away, and a scoped token does not stop the failure mode people actually fear, which is an agent being talked into a legitimate but wrong action.
- —Both vendor previews already issue on-behalf-of tokens. If they converge on the IETF draft, our broker becomes an adapter and the recommendation becomes 'turn on the feature'.
- —Policy authoring is the cost, and we have no evidence a delivery team can do it. A pattern that needs a security engineer per engagement does not scale past the pilots.
- —The PoC replayed 214 calls from one servicing agent. Eleven blocks is a small number to hang a high-impact score on, and none of the eleven was adversarial.
- —Prompt injection makes the agent's legitimate token the attack surface. Scoping reduces blast radius but the client's question is 'can the agent be tricked', and the honest answer is still yes.
Source diversity
- Identity / security30%
- Agent infra25%
- Vendor20%
- Regulatory10%
- Internal / Engel15%
A field supported by one epistemic community is a flag, not a finding.
Cross-pollination · typed joins
Connected, not merely similar.
Enabling, compounding, substituting, blocking. A satisfied dependency trigger is a far stronger signal than semantic proximity.
The broker needs a single choke point for tool calls; the gateway is already that choke point for model calls.
Non-human identity is the attack surface adversarial agents will go after first; the broker is the control.
An agent that acts unprompted cannot exist in a regulated client without delegated, expiring authority it did not ask for at runtime.
Share graph
Provenance running forward.
Discovery, not accountability. No counts, no rankings, no rollups to managers.
Convergence · who else is here
- OGOllie Grant · Product engineer2 drops
- CDClaire Dubois · Sector owner · Banking2 drops
- TOTom Okafor · Research engineer · agents1 drop
Several people’s drops meet here. An informal working group already exists and probably does not know it.
Lineage
What this field produced, and what it killed.
Experiments, recommendations and graveyard entries stay attached. The reasoning that killed a claim is the reusable asset.
Agents act under delegated, scoped, expiring authority — never a service account
strength strong · 26 citations · review 3 Feb 2027
Delegated-authority broker for agent tool calls
A broker that mints per-task, resource-scoped, twenty-minute tokens on behalf of a named user lets an agent complete the banking servicing pattern's twelve tool calls with zero standing credentials and under 80ms added latency per call.
Plain OAuth scopes are enough for agent delegation
“Never got a tenant to fail in.” · lived 2 months
Open questions · return to the pile
Every run leaves a record. Separately, its question either closes or returns to the pile with notes — which is what the next person proposing the same thing will see.
- 01Can Cedar-style policy templates cover 80% of servicing-agent tool calls without hand-written rules?
- 02When the vendor previews go GA, does the broker collapse to an adapter, and what do we tell clients who already built on it?
- 03What does the audit trail need to contain to satisfy a CPS 234 tester, as opposed to a developer?