Mental model
Delegation gives the executor a narrow capability for one purpose, not the user's durable credential or the application's full authority.
Learning outcomes
- Explain the mechanism and ownership boundaries behind Delegated Credentials for AI Tools.
- Compare the main design alternatives and their operational trade-offs.
- Diagnose common failures and select evidence for a production decision.
Theory
Issue short-lived tokens bound to audience, subject, scopes, resource, and transaction where possible. Keep secret material outside prompts and logs, rotate it through a broker, and revoke it when approval or session state changes.
Trade-offs
Per-action credentials reduce exposure but require token exchange and reliable identity propagation. Shared service credentials are simpler but erase attribution and tenant boundaries.
Failure modes and misconceptions
Embedding tokens in prompts; overbroad scopes; long expiry; accepting tokens at unintended audiences; logging secrets; and reusing credentials across tenants.
Decision scenario
An agent needs temporary access to update one calendar event. Define the token audience, scope, lifetime, and audit fields.
Why is a short-lived token still unsafe if it is not audience or resource bound?
Primary sources
oauth-security-bcpmcp-specification