Delegate On-Behalf-Of Authorization

Use Case

Preserve the originating user’s identity, permissions, and intent when an agent acts on that person’s behalf. Use OAuth-based delegation and expiring tokens to keep downstream tool access attributable, narrowly scoped, and time-bound.

Challenges

Traditional integrations often lose user context or pass excessive privileges through agent workflows. This creates several control gaps:

• Security teams cannot identify who authorized an action
• Agents may inherit more privilege than the user or task
• Delegated authority can persist beyond its valid duration
• Downstream tool calls may lose the original audit context

Solution

PointGuard AI provides a comprehensive solution for on-behalf-of authorization across agent workflows:

1. Capture the delegating user. Authenticate the originating user and associate that identity with the agent request.

2. Define scope and duration. Use OAuth-based delegation and expiring tokens limited by resource, action, agent, and time.

3. Enforce every downstream call. Use MCP Security Gateway to apply delegated context when the agent reaches tools, APIs, and enterprise systems.

4. Preserve the audit chain. Record the complete user-to-agent-to-tool path so each action remains attributable and reviewable.

Agents can scale user-directed automation without exceeding human authority or losing accountability.

Risks Addressed

Applicable framework risks and controls include:

OWASP Top 10 for LLMs

• LLM03:2026 Excessive Agency

OWASP Top 10 for Agentic Applications

• ASI02: Tool Misuse and Exploitation
• ASI03: Identity and Privilege Abuse
• ASI07: Insecure Inter-Agent Communication

NIST AI Risk Management Framework

• GOVERN 1.4: Transparent risk policies, procedures, and controls are established
• GOVERN 2.1: Roles, responsibilities, and communication are documented and clear
• MAP 1.1: Intended use, context, users, and lifecycle risks are documented
• MANAGE 4.1: Post-deployment monitoring and change management are implemented