---
title: "Token Exchange"
description: "1 posts about Token Exchange, summarised, each linking to the original."
---

# Token Exchange
> 1 posts about Token Exchange, summarised, each linking to the original.

## Articles

### [On-Behalf-Of Is a Pattern. Token Exchange Is the Standard.](https://yomu.fyi/post/on-behalf-of-is-a-pattern-token-exchange-is-the-standard.md)
- Company: [Auth0](https://yomu.fyi/company/auth0.md)
- Author: Andrea Chiarelli
- Published: Oct 16, 2026
- Type: Explainer

The post distinguishes the On-Behalf-Of pattern from the OAuth 2.0 Token Exchange standard (RFC 8693) and Microsoft’s implementation, warning against forwarding a user’s token downstream as it breaks the audience trust boundary. Token Exchange uses a subject\_token for the user’s identity and an optional actor\_token to record the calling service, with a chainable act claim for multi-hop calls. Microsoft’s implementation uses a jwt-bearer grant, only works for user principals, and can mint SAML assertions for legacy integrations, but the resulting token must never be relayed back to the client. For AI agents, neither OBO nor Token Exchange handles explicit user delegation, so integrators must log act claims, scope tokens to specific tasks, issue per-agent credentials, and build audit trails. The post notes the confused deputy problem resurfaces with agents, and regulatory transparency requirements around automated decision-making are already in effect.