Access Control & Identity for AI Components & Users · Authentication
Short-lived tokens for federated agents
Verify that AI agents in federated or multi-system deployments authenticate using short-lived, minimal-scoped, cryptographically signed tokens.
OWASP AISVS v1.01, requirement 5.1.2
In plain English
When agents call other systems, particularly across organisational or platform boundaries, give them tokens that expire quickly, allow only what the call needs and are cryptographically signed. A stolen token is then worth little, and the receiving system can verify it without trusting the network.
What good looks like
- Agent tokens expire in minutes, or an hour at most.
- Each token is limited to a specific audience (the service it is for) and a narrow set of actions.
- Tokens are signed, and the receiving service checks signature, issuer, audience and expiry on every call.
- No long-lived shared secret is stored in the agent's configuration.
How teams usually do it
- OAuth 2.0 client credentials or token exchange (RFC 8693) to issue narrow, short-lived tokens per downstream service.
- Workload identity in place of stored secrets: cloud workload identity federation, or SPIFFE/SPIRE identities that are issued and rotated automatically.
- Sender-constrained tokens (DPoP or mutual TLS binding), so a token is useless without the key of the agent it was issued to.
Suggested evidence
- Token lifetimes and scopes from the issuing service.
- Receiving-service configuration showing full token validation.
- A decoded sample token.
Common mistakes
- One long-lived API key shared by every agent.
- Scopes that allow everything because narrowing them was hard.
- Tokens with no audience, so one issued for service A is accepted by service B.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.