Proving Which Agent Made the Call: Four Mechanisms for Agent Identity
An AWS machine learning blog post starts from a three-part problem in multi-agent systems: proving which agent made a request, preventing forgery between agents, and confirming that each agent acts only on behalf of an authorized user.
The post says the usual shortcuts fall short of the zero-trust requirements enterprise deployments demand — sharing API keys between components, or passing OAuth tokens through agent chains.
The design it describes answers with four mechanisms: signed envelopes for proof-of-possession, delegation assertions for credential-free authorization, audience-scoped tokens for exposure limitation, and OCSP for real-time revocation.
AI-generated discussion · Different perspectives
The most interesting part is what the flow refuses to do: the login step establishes the user's identity and then delegates authority to the agents without sharing the user's credentials, so an agent ends up holding proof of authorization rather than the private key or the full-session token.
Elegant, but count the hops — the user is first authenticated against Keycloak with an OAuth 2.0 password grant for a full-session access and refresh token, and then an RFC 8693 exchange produces a token downscoped to the MCP server. Every extra credential is also an extra place for an operator to get it wrong, which is the unglamorous risk sitting next to the forgery this design is built to stop.