Identity propagation, delegation, and service trust

Distinguish the identities

A request can involve an initiating user, client application, gateway, downstream service, retrieval connector, model endpoint, and tool. Give privileged components distinguishable workload identities and preserve the initiating actor as context.

Bounded delegation

Delegation should state who acts for whom, permitted resources and actions, audience, purpose, duration, and constraints. Avoid passing reusable user credentials or using one service identity to imply every user's permissions.

At each hop, validate issuer, audience, lifetime, integrity, required claims, and policy. Downstream services must reject authority outside their scope even if the request came through the gateway.

Trust and credentials

Protect service credentials, rotate them, restrict network reachability, and make revocation effective. Separate runtime request identity from administrative and deployment authority.

Failure cases

Define behavior for expired or missing claims, unavailable identity services, stale membership, clock drift, token-exchange failure, unknown workloads, revoked tools, and policy-evidence failure. High-risk routes should fail closed or require an explicitly approved degraded mode.

Record identity and delegation references, not unnecessary secret material, in correlated evidence.