A recent OAuth Internet-Draft frames the agent identity problem as delegated authority rather than authentication alone. A user may be logged in correctly while an agent, subagent, or tool acts with ambiguous provenance and excessive scope.
The proposal extends transaction tokens so sub identifies the principal and act identifies the acting agent. Optional agent context can carry bounded metadata, while an actchain can preserve delegation lineage. Replacement tokens are expected to narrow permissions as work moves downstream rather than copy the original authority unchanged.
Transaction tokens are short-lived and signed for a particular workflow boundary, making authorization decisions and later audits refer to the same delegation record. That is a better fit for multi-agent systems than sharing one user's broad bearer token across every component.
The document was published April 11 and its individual draft is now expired and replaced. It has no formal IETF standing and must not be described as a standard. The architecture is still useful as a design prompt: every agent action should answer who requested it, which agent acted, what scope was delegated, and how that scope narrowed.