Study OAuth2 concepts

1. 01

   Concepts & system design

   60 min· read · map the mechanismtimer

   R22 — RFC 9700 OAuth 2.0 Security BCP

   R23 — RFC 8693 OAuth 2.0 Token Exchange

   Read the assigned sections; map the mechanism, threat model and trade-offs.

2. 02

   Project implementation

   120 min· build · integrate · debugtimer

   Study OAuth 2.0 Security Best Current Practice (RFC 9700) and Token Exchange (RFC 8693): sub (user subject) vs. act (agent actor) claims, narrow scopes, aud (resource audience) binding, short TTL, and revocation. Design the scope matrix for P3.

   Build, integrate, debug and improve the increment in the active project.

3. 03

   Security lab

   60 min· attack your own systemtimer

   Threat-model token leakage, confused-deputy privilege escalation, and token replay across tools.

   Test the abuse case, failure path, authorization bypass or resource limit.

4. 04

   Verification & evidence

   30 min· test · record evidencetimer

   D7 identity & delegation architecture diagram and scope matrix.

   Add or run regression tests; record the 9-point evidence record.

5. 05

   Deliberate practice & Socratic review

   30 min· explain aloud · update gapstimer

   Answer the 8 Socratic questions without notes: What? Why? How? What if? Why not? How can I prove it? Where can it break? What have I learned?

   Re-explain the hardest concept aloud, inspect one edge case, update the gap log.

6. total5 h

• R22OAuth 2.0 Security BCP (RFC 9700)↗ rfc-editor.org

  RFC 6749 core flows + RFC 9700 security best practices: narrow scopes, audience restriction, token leakage, and replay.

• R23OAuth 2.0 Token Exchange (RFC 8693)↗ rfc-editor.org

  Delegated authorization patterns, sub (subject) vs. act (actor) claims for agent delegation.

Read only the named sections needed for today's task. Reading sits inside the 60-minute concepts block; it is not extra time.

• docsRFC Editor (IETF) · ~60 min read
  RFC 9700: Best Current Practice for OAuth 2.0 Security

  Sections 2.2 and 2.3 mandate replay prevention, audience restriction and narrow access-token privilege, which is the justification for short TTLs plus `aud` binding in the scope matrix.

  R22moved 2026-11-11
• videoSascha Preibisch · ~10 min
  OAuth 2.0 - Token Exchange

  Explains RFC 8693 exchange of one token for another with narrowed scope and a different audience, the core move the identity broker performs per tool call.

  R23checked 2026-11-11
• videoGravitee · ~10 min
  Stop Impersonating Users: Secure AI Agent Delegation with RFC 8693

  Applies token exchange to agentic workflows and shows why delegation (with an actor identity) is safer than the agent impersonating the user outright.

  R23checked 2026-11-11
• articleSagara Gunathunga · 14 min read
  OAuth 2.0 Token Exchange (RFC 8693) in Practice

  Walks a real exchange through an API gateway and explains that only the outermost `act` claim is trusted for policy while nested claims are the delegation history.

  R23checked 2026-11-11
• docsRFC Editor (IETF) · ~45 min read
  RFC 8693: OAuth 2.0 Token Exchange

  Section 4.1 defines the `sub` vs `act` split and the nesting rule for delegation chains, the exact claim model your P3 scope matrix has to encode.

  R23moved 2026-11-11

A lab is complete only when it produces evidence. Installing PyRIT, Garak, Presidio or TransformerLens is not completion. Saved on this device only.