Add delegation and AI agent token exchange docs

.vale/styles/config/vocabularies/vocab/accept.txt

@@ -80,3 +80,7 @@ Moesif
 multiple_client_secrets
 multiple_client_secrets_enabled
 Expiration
+subject_token
+actor_token
+actor_token_type
+api_base_path

en/asgardeo/docs/guides/agentic-ai/ai-agents/token-exchange-for-agents.md

@@ -0,0 +1,3 @@
+{% set api_base_path = "https://api.asgardeo.io/t/{organization_name}" %}
+
+{% include "../../../../../includes/guides/agentic-ai/ai-agents/token-exchange-for-agents.md" %}

en/asgardeo/docs/guides/authorization/delegation.md

@@ -0,0 +1,3 @@
+{% set base_url = "https://api.asgardeo.io/t/{organization_name}" %}
+
+{% include "../../../../includes/guides/authorization/delegation.md" %}

en/asgardeo/mkdocs.yml

@@ -539,6 +539,7 @@ nav:
           - User impersonation: guides/authorization/user-impersonation/index.md
           - via Console: guides/authorization/user-impersonation/via-console.md
           - via business application (advanced): guides/authorization/user-impersonation/via-business-application.md
+        - Delegation: guides/authorization/delegation.md
       - Identity Verification:
         - Identity Verification: guides/identity-verification/index.md
         - Configure an Identity Verification Provider: guides/identity-verification/configure-identity-verification-provider.md
@@ -776,6 +777,7 @@ nav:
           - Agent credentials: guides/agentic-ai/ai-agents/agent-credentials.md
           - Access control for agents: guides/agentic-ai/ai-agents/access-control-for-agents.md
           - Agent authentication: guides/agentic-ai/ai-agents/agent-authentication.md
+          - Token exchange for agents: guides/agentic-ai/ai-agents/token-exchange-for-agents.md
       - Verifiable Credentials:
         - Overview: guides/verifiable-credentials/index.md
         - Issue verifiable credentials to a digital wallet: guides/verifiable-credentials/issue-vc.md

en/identity-server/next/docs/guides/agentic-ai/ai-agents/token-exchange-for-agents.md

@@ -0,0 +1,3 @@
+{% set api_base_path = "https://localhost:9443/t/{root_organization_handle}" %}
+
+{% include "../../../../../../includes/guides/agentic-ai/ai-agents/token-exchange-for-agents.md" %}

en/identity-server/next/docs/guides/authorization/delegation.md

@@ -0,0 +1,3 @@
+{% set base_url = "https://localhost:9443" %}
+
+{% include "../../../../../includes/guides/authorization/delegation.md" %}

en/identity-server/next/mkdocs.yml

@@ -764,6 +764,7 @@ nav:
           - User impersonation: guides/authorization/user-impersonation/index.md
           - via Console: guides/authorization/user-impersonation/via-console.md
           - via business application (advanced): guides/authorization/user-impersonation/via-business-application.md
+        - Delegation: guides/authorization/delegation.md
         - Rich Authorization Requests: guides/authorization/rich-authorization-requests.md
       - Identity Verification:
         - Identity Verification: guides/identity-verification/index.md
@@ -997,6 +998,7 @@ nav:
           - Agent credentials: guides/agentic-ai/ai-agents/agent-credentials.md
           - Access control for agents: guides/agentic-ai/ai-agents/access-control-for-agents.md
           - Agent authentication: guides/agentic-ai/ai-agents/agent-authentication.md
+          - Token exchange for agents: guides/agentic-ai/ai-agents/token-exchange-for-agents.md
       - Verifiable Credentials:
         - Overview: guides/verifiable-credentials/index.md
         - Issue verifiable credentials to a digital wallet: guides/verifiable-credentials/issue-vc.md

en/includes/guides/agentic-ai/ai-agents/agent-authentication.md

@@ -237,3 +237,13 @@ The flow proceeds as follows:
     To use OBO tokens with CIBA, agent identities must be enabled in {{ product_name }}, and the application must have the CIBA grant type enabled. Learn more about [registering background agents]({{base_path}}/guides/agentic-ai/ai-agents/register-and-manage-agents/#registering-an-ai-agent).
 
 {% endif %}
+
+{% if product_name == "WSO2 Identity Platform" or (product_name == "WSO2 Identity Server" and is_version not in ["7.0.0", "7.1.0", "7.2.0", "7.3.0"]) %}
+
+### Using token exchange for on-behalf-of delegation
+
+When an agent receives a token issued for the user, the [token exchange grant]({{base_path}}/guides/authentication/configure-token-exchange/) can add the agent as the acting party without any new user interaction. The agent presents its own `actor_token` alongside the user's token, and {{ product_name }} issues a token that carries the user in `sub` and the agent in the `act` claim. Successive exchanges nest the `act` claim, so a chain of agents remains traceable in a single token.
+
+For instructions, see [Token exchange for AI agents]({{base_path}}/guides/agentic-ai/ai-agents/token-exchange-for-agents/).
+
+{% endif %}

en/includes/guides/agentic-ai/ai-agents/token-exchange-for-agents.md

@@ -0,0 +1,120 @@
+<!-- vale off -->
+# Token Exchange for AI Agents
+<!-- vale on -->
+
+This guide walks you through how an AI agent can act on behalf of a user by exchanging a token that the user already holds. The flow uses the [token exchange grant]({{base_path}}/guides/authentication/configure-token-exchange/), as defined in the [OAuth 2.0 Token Exchange specification (RFC 8693)](https://datatracker.ietf.org/doc/html/rfc8693).
+
+The issued token identifies the user in the `sub` claim and records the agent as the acting party in the `act` claim. A resource server can then see both identities in a single token.
+
+!!! note "Agent friendly delegation mechanism"
+    - This flow does **not use redirects** and needs **no new user interaction**.
+    - It is suited to bringing an agent into work the user has already authorized.
+    - The agent reuses the token it already obtained through its own [authentication flow]({{base_path}}/guides/agentic-ai/ai-agents/agent-authentication/#ai-agent-acting-on-its-own).
+
+---
+
+## How the flow works
+
+![Agent Delegation via Token Exchange Flow Diagram](../../../assets/img/guides/agentic-ai/ai-agent-token-exchange-flow.png)
+
+As shown in the above sequence diagram, the flow proceeds as follows.
+
+1. **Agent Authentication**
+   The agent authenticates with its **Agent ID** and **Agent Secret** and obtains its own access token, as described in [AI agent acting on its own]({{base_path}}/guides/agentic-ai/ai-agents/agent-authentication/#ai-agent-acting-on-its-own). This token becomes the `actor_token`.
+
+2. **Task Delegation**
+   The user, or an agent earlier in the chain, delegates a task to the agent and provides the subject token. The subject token identifies the user on whose behalf the agent acts. {{ product_name }} accepts a token issued by itself or by a trusted token issuer, as described in [Token exchange flows]({{base_path}}/guides/authentication/configure-token-exchange/#token-exchange-flows).
+
+3. **Token Exchange Request**
+   The agent sends both tokens to the token endpoint using the token exchange grant.
+
+4. **Validation**
+   {{ product_name }} validates both tokens, resolves the agent from the `sub` claim of the actor token, and verifies that the agent is a registered and active identity in the organization.
+
+5. **Delegated Token Issuance**
+   {{ product_name }} issues an access token that carries the user in `sub` and the agent in `act.sub`.
+
+6. **Authorized Request**
+   The agent calls the protected resource with the delegated token. The resource server can authorize the request against the user's identity while attributing the action to the agent.
+
+## Requesting a delegated token
+
+!!! note "Before you begin"
+    - Enable the token exchange grant for the application that requests the token, as described in [Enable token exchange in your app]({{base_path}}/guides/authentication/configure-token-exchange/#enable-token-exchange-in-your-app).
+    - Configure the agent's application to issue `JWT` access tokens. {{ product_name }} rejects opaque actor tokens.
+
+Send both tokens to the token endpoint.
+
+=== "Request Format"
+
+    ``` bash
+    curl --location '{{ api_base_path }}/oauth2/token' \
+    --header 'Content-Type: application/x-www-form-urlencoded' \
+    --header 'Authorization: Basic <base64 Encoded (clientId:clientSecret)>' \
+    --data-urlencode 'grant_type=urn:ietf:params:oauth:grant-type:token-exchange' \
+    --data-urlencode 'subject_token={user_token}' \
+    --data-urlencode 'subject_token_type=urn:ietf:params:oauth:token-type:jwt' \
+    --data-urlencode 'actor_token={agent_token}' \
+    --data-urlencode 'actor_token_type=urn:ietf:params:oauth:token-type:jwt' \
+    --data-urlencode 'requested_token_type=urn:ietf:params:oauth:token-type:access_token' \
+    --data-urlencode 'scope={requested_scopes}'
+    ```
+
+The request contains the following delegation parameters:
+
+<table>
+    <tr>
+        <th>Parameter</th>
+        <th>Description</th>
+    </tr>
+    <tr>
+        <td><code>subject_token</code></td>
+        <td>A JWT token that identifies the user on whose behalf the agent acts.</td>
+    </tr>
+    <tr>
+        <td><code>actor_token</code></td>
+        <td>A JWT token issued by {{ product_name }} for the agent.</td>
+    </tr>
+    <tr>
+        <td><code>actor_token_type</code></td>
+        <td>Should be <code>urn:ietf:params:oauth:token-type:access_token</code> or
+        <code>urn:ietf:params:oauth:token-type:jwt</code>.</td>
+    </tr>
+</table>
+
+## The delegated token
+
+The decoded token identifies the user in `sub` and the agent in `act.sub`.
+
+```json
+{
+  "sub": "<user_identifier>",
+  "act": {
+    "sub": "<agent_identifier>"
+  },
+  ...
+}
+```
+
+A resource server can use the `act` claim to record which agent acted for the user, or to apply policies that depend on the acting agent. This gives you an audit trail that attributes the action to the agent independently of the user, as described in [Comprehensive auditing and explainability]({{base_path}}/guides/agentic-ai/ai-agents/#comprehensive-auditing-and-explainability).
+
+## Chaining delegation across agents
+
+When an agent hands a task to another agent, the second agent exchanges the delegated token again with its own actor token. The new agent becomes the current acting party and the existing `act` claim nests under it, so the token carries the full chain.
+
+```json
+{
+  "sub": "<user_identifier>",
+  "act": {
+    "sub": "<second_agent_identifier>",
+    "act": {
+      "sub": "<first_agent_identifier>"
+    }
+  },
+  ...
+}
+```
+
+The most recent agent appears at the top level of the chain. When the request presents no actor token, {{ product_name }} carries the existing chain forward unchanged. An agent that re-exchanges a token it received can't alter the chain behind it.
+
+To learn more about the delegation model and the `act` claim, see [Delegation]({{base_path}}/guides/authorization/delegation/).