The agent borrows the user's identity, scoped to the task
A service account with every permission is how an injected instruction becomes an incident. Exchange the user's token for one scoped to the task and aimed at one downstream, and let the downstream enforce the user's own permissions.
grant_type=token-exchange subject=user actor=agent
audience=crm scope=contacts:readThe audit log then says who, through which agent, did what. "The agent did it" is not an entry an auditor accepts.
ai-agentssecurity
Longer version: the post this came from.