feat: investigate agent-side token propagation for per-user authorization at tools

[mrsabath]

Problem

AuthBridge supports two outbound token acquisition modes:

1. Token Exchange (RFC 8693) — preserves the end user's identity (sub claim) when the outbound request carries an Authorization header
2. Client Credentials fallback (feat: add client_credentials fallback for outbound requests without Authorization header #171) — uses the agent's own SPIFFE identity when no Authorization header is present

Currently, agent frameworks (A2A SDK, LangChain, LlamaIndex) do not propagate the inbound Bearer token to outbound tool calls. The agent receives the user's token, processes the prompt with an LLM, and makes fresh HTTP calls without any Authorization header. This means the client_credentials path is always used, and the tool cannot distinguish which user triggered the call.

Desired Behavior

When Alice sends a request to an agent that calls a tool, the tool should receive a token with sub=alice (not sub=agent-spiffe-id). This enables:

• Per-user authorization at the tool level
• Accurate audit trails
• Scope-based access differentiation per user (e.g., Alice gets public access, Bob gets privileged)

Investigation Areas

Short-term: A2A SDK token propagation

Investigate whether the A2A SDK can be extended to:

1. Capture the inbound Authorization: Bearer <token> from the HTTP request
2. Store it in a request-scoped context (per-request, not global)
3. Inject it into outbound HTTP calls made during that request's processing

Key challenges:

• Concurrency — a shared agent handles multiple users simultaneously. The framework must correctly associate each outbound call with the right inbound user.
• Framework diversity — different agent frameworks (A2A SDK, LangChain, CrewAI) have different tool-calling abstractions.

Long-term: IETF Transaction Tokens for Agents

Two IETF drafts define tokens that carry both agent and user identity:

• draft-liu-oauth-a2a-profile (Oct 2025) — A2A profile for OAuth Transaction Tokens
• draft-oauth-transaction-tokens-for-agents (Nov 2025) — Transaction Tokens with actor (agent) and principal (human) fields

These would allow AuthBridge to issue tokens that identify both the agent AND the user, eliminating the trade-off between the two current modes.

Current Workaround

PR #171 implements the client_credentials fallback. The code structure already prefers token exchange when an Authorization header is present — so if the agent framework starts propagating tokens, token exchange activates automatically with no AuthBridge code changes.

Related

• feat: go-processor should fall back to client_credentials grant when outbound request has no Authorization header #170 — original issue for client_credentials fallback
• feat: add client_credentials fallback for outbound requests without Authorization header #171 — PR implementing the fallback
• epic: end-to-end demo validation for GitHub Issue Agent with AuthBridge #173 — epic tracking the end-to-end demo validation

[huang195]

An even shorter-term alternative is to make a 1-liner change in the agent code:

  # In the agent's task handler, where it calls another agent or tool:
  await a2a_client.send_message(
      message=...,
      headers={"Authorization": request.headers["authorization"]}  # ← one line
  )

@mrsabath ^^

[github-actions]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed in 14 days if no further activity occurs. If this issue is still relevant, please comment or remove the stale label.

[github-actions]

This issue was closed because it has been stale for 14 days with no activity. Feel free to reopen if this is still relevant.