On-Behalf-Of Token Exchange vs. the Blanket-Identity Anti-Pattern
The downstream call should carry the user's identity, not the agent's.
✓ On-Behalf-Of Flow
User
Agent
holds user's token
Token Exchange
issues scoped token
Downstream API
acts AS the user
✗ Blanket-Identity Anti-Pattern
User
Agent
uses own admin cred
Downstream API
acts as "the platform"
No per-user scoping — every request looks identical, and equally powerful.