{
  "schema": "vedokrok.public-item.v1",
  "release_id": "MHC-RPUB-20260920-75ad787a",
  "url": "/knowledge/exchange-broad-credentials-for-task-scoped-access",
  "id": "MHC-D-RESEARCH-1173",
  "version": "0.1.0",
  "title": "Exchange broad credentials for task-scoped access",
  "summary": "Do not hand an agent the master key when it needs one door for one job.",
  "kind": "protocol",
  "body": "At the tool boundary, exchange delegated identity for a short-lived credential scoped to the resource and action the task actually needs. Keep policy and approval outside the model, and log which authority was granted for each consequential call.",
  "limits": [
    "Scoped tokens are not a substitute for authorization design, audit or human approval where the impact requires it."
  ],
  "topics": [
    "union-ai-runtime-verification-2026"
  ],
  "intents": [],
  "source_ids": [
    "RS-3834F341D660F727"
  ],
  "evidence": [
    {
      "claim": "Broad long-lived credentials can be exchanged at runtime for tool-specific, task-scoped credentials so an agent receives only the authority needed for the current action.",
      "source_id": "RS-3834F341D660F727",
      "role": "supports",
      "note": "Token exchange does not replace authorization policy, approval or audit. The credential issuer and downstream service must actually enforce the requested scope.",
      "locator": "4:52-21:32, enforcement point, token exchange, task-scoped credentials and resource-first scope design"
    }
  ],
  "use_when": [
    "An agent currently receives a long-lived API key with more authority than the current task requires."
  ],
  "avoid_when": [
    "Scoped tokens are not a substitute for authorization design, audit or human approval where the impact requires it."
  ],
  "example": "An incident agent may read the current ticket and restart one service, but it does not inherit a broad cloud administrator key for the entire account.",
  "check": "A mistaken model action outside the task's granted scope is rejected even if the prompt asks for it.",
  "steps": [
    "Start scope design from the resource and action being requested.",
    "Issue or exchange for the narrowest practical short-lived credential.",
    "Enforce scope in the downstream service, not in prompt text.",
    "Require approval for authority the current task should not receive automatically.",
    "Log the granted scope with the action."
  ],
  "sources": [
    {
      "id": "RS-3834F341D660F727",
      "title": "It's 10pm. Do You Know Where Your Agents Are?",
      "url": "https://ai.engineer/talks/I3znWC3MEXM-its-10pm-do-you-know-where"
    }
  ],
  "relations": [
    {
      "from": "MHC-D-RESEARCH-1173",
      "to": "MHC-D-RESEARCH-0311",
      "type": "useful_with",
      "url": "/knowledge/run-agent-actions-in-the-user-s-authorization-context"
    }
  ],
  "collections": [
    {
      "id": "RC-ACD6385FB70207D3",
      "title": "Operate AI agents as systems you can replay, verify and constrain",
      "url": "/collections/operate-ai-agents-as-systems-you-can-replay-verify-and-constrain"
    }
  ]
}