{
  "post": {
    "title": "Delegated access for agents: OAuth 2.1, PKCE and scoped tokens",
    "url": "https://bardak.ai/posts/delegated-access-for-ai-agents",
    "updated": "2026-10-29T18:56:02.380Z"
  },
  "citation": "Delegated access for agents: OAuth 2.1, PKCE and scoped tokens, Ivan Bardak, bardak.ai, https://bardak.ai/posts/delegated-access-for-ai-agents",
  "datasets": [
    {
      "key": "delegated-access-with-mcp-who-acts-on-whose-behalf",
      "title": "Delegated access with MCP: who acts on whose behalf",
      "type": "knowledgeGraph",
      "source": "Model Context Protocol specification, version 2026-07-28: Authorization",
      "caption": "The MCP server never forwards the agent's token upstream. It is a resource server for the agent and a client of the upstream system, with its own credentials and its own scopes.",
      "csv": "https://bardak.ai/data/delegated-access-for-ai-agents/delegated-access-with-mcp-who-acts-on-whose-behalf.csv",
      "header": [
        "source",
        "target",
        "relation"
      ],
      "rows": [
        [
          "User",
          "Authorization server",
          "signs in and approves scopes"
        ],
        [
          "Authorization server",
          "Agent client",
          "issues a token for one MCP server"
        ],
        [
          "Agent client",
          "MCP server",
          "calls tools with that token"
        ],
        [
          "MCP server",
          "Authorization server",
          "validates audience and scopes"
        ],
        [
          "MCP server",
          "Upstream authorization server",
          "gets its own token"
        ],
        [
          "MCP server",
          "Upstream API",
          "calls with the upstream token"
        ],
        [
          "Agent client",
          "User",
          "asks before destructive actions"
        ]
      ]
    },
    {
      "key": "how-mcp-authorization-has-evolved",
      "title": "How MCP authorization has evolved",
      "type": "benchmarkTable",
      "source": "Model Context Protocol specification and changelogs, 2025-03-26 to 2026-07-28",
      "caption": "Each row is a requirement for HTTP servers that implement authorization. The changelogs list every change with its proposal number.",
      "csv": "https://bardak.ai/data/delegated-access-for-ai-agents/how-mcp-authorization-has-evolved.csv",
      "header": [
        "Revision",
        "What changed",
        "Why it matters"
      ],
      "rows": [
        [
          "2025-03-26",
          "First authorization framework: OAuth 2.1 required, PKCE required for all clients",
          "A standard way to sign users in, instead of pasted API keys"
        ],
        [
          "2025-06-18",
          "MCP servers become OAuth resource servers with Protected Resource Metadata (RFC 9728); clients must send resource indicators (RFC 8707); servers must check the token audience; token passthrough forbidden",
          "A token issued for one server cannot be replayed against another, and the identity provider can be a separate system"
        ],
        [
          "2025-11-25",
          "Client ID Metadata Documents recommended over dynamic registration; scopes announced in the server challenge; step-up when a call needs more scope",
          "Least privilege by default, with more rights requested only when needed"
        ],
        [
          "2026-07-28",
          "Dynamic client registration deprecated; clients must validate the issuer (RFC 9207) and keep credentials per authorization server; tool lists may depend on granted scopes",
          "Closes mix-up attacks between identity providers, and hides tools the user cannot use"
        ]
      ]
    },
    {
      "key": "delegated-access-checklist-for-an-agent",
      "title": "Delegated access checklist for an agent",
      "type": "benchmarkTable",
      "source": "",
      "caption": "",
      "csv": "https://bardak.ai/data/delegated-access-for-ai-agents/delegated-access-checklist-for-an-agent.csv",
      "header": [
        "Check",
        "Pass when"
      ],
      "rows": [
        [
          "Identity",
          "The agent acts for a signed-in user through OAuth 2.1 with PKCE; no shared admin keys"
        ],
        [
          "Delegation visible",
          "Logs record both the user and the agent for every call"
        ],
        [
          "Audience",
          "Tokens are requested for one MCP server and rejected anywhere else"
        ],
        [
          "No passthrough",
          "The MCP server uses its own upstream credentials"
        ],
        [
          "Scopes",
          "Per capability, read and write apart, destructive actions separate, no wildcards"
        ],
        [
          "Step-up",
          "Extra scope is requested when needed, with user consent"
        ],
        [
          "Server-side checks",
          "Role and record-level rules enforced by the server, not the prompt"
        ],
        [
          "Lifetime",
          "Short-lived access tokens, sender-bound refresh tokens, revocation on exit"
        ],
        [
          "Static keys",
          "Only where unavoidable, in a secrets manager, scoped and rotated"
        ]
      ]
    },
    {
      "key": "appraising-the-evidence",
      "title": "Appraising the evidence",
      "type": "benchmarkTable",
      "source": "",
      "caption": "",
      "csv": "https://bardak.ai/data/delegated-access-for-ai-agents/appraising-the-evidence.csv",
      "header": [
        "Evidence",
        "Strength",
        "Main limitation"
      ],
      "rows": [
        [
          "MCP specification, RFC 8693, OAuth 2.1 draft",
          "Authoritative definitions of what must happen",
          "Standards say what is required, not how often it is done well; OAuth 2.1 is still a draft"
        ],
        [
          "OWASP lists",
          "Broad expert consensus",
          "Categories, not measurements"
        ],
        [
          "GitGuardian report",
          "Large-scale measurement of public code",
          "A security vendor measuring the problem it sells a solution for; public repositories only"
        ],
        [
          "My client work",
          "Direct experience",
          "One practitioner"
        ]
      ]
    }
  ]
}