Implement a local delegated-access simulation with short-lived…

1. 01

   Concepts & system design

   60 min· read · map the mechanismtimer

   R22 — OAuth token validation & audience restrictions

   R23 — Actor/subject token exchange

   Read the assigned sections; map the mechanism, threat model and trade-offs.

2. 02

   Project implementation

   120 min· build · integrate · debugtimer

   Implement the local identity-broker (D7) that exchanges a user's session token for a short-lived, task-scoped, audience-bound JWT for a specific tool call.

   Build, integrate, debug and improve the increment in the active project.

3. 03

   Security lab

   60 min· attack your own systemtimer

   Verify the agent cannot inherit broader user permissions than the approved task scope, cannot reuse a token on a different resource (aud mismatch), and fails closed upon token expiry or revocation.

   Test the abuse case, failure path, authorization bypass or resource limit.

4. 04

   Verification & evidence

   30 min· test · record evidencetimer

   Negative authorization test suite for D7 (expired token, wrong audience,missing scope, revoked token).

   Add or run regression tests; record the 9-point evidence record.

5. 05

   Deliberate practice & Socratic review

   30 min· explain aloud · update gapstimer

   Answer the 8 Socratic questions without notes: What? Why? How? What if? Why not? How can I prove it? Where can it break? What have I learned?

   Re-explain the hardest concept aloud, inspect one edge case, update the gap log.

6. total5 h

• R22OAuth 2.0 Security BCP (RFC 9700)↗ rfc-editor.org

  RFC 6749 core flows + RFC 9700 security best practices: narrow scopes, audience restriction, token leakage, and replay.

• R23OAuth 2.0 Token Exchange (RFC 8693)↗ rfc-editor.org

  Delegated authorization patterns, sub (subject) vs. act (actor) claims for agent delegation.

Read only the named sections needed for today's task. Reading sits inside the 60-minute concepts block; it is not extra time.

• docsOWASP · ~20 min read
  OAuth2 - OWASP Cheat Sheet Series

  Implementation-level checklist for token replay prevention, audience-restricted bearer tokens and PoP, the properties the short-lived task-scoped JWT must satisfy.

  R22checked 2026-11-11
• videoCode with Josh · ~45 min
  Secure FastAPI API with JWT (OAuth2) – Python Token Authentication Tutorial

  Builds issuance and verification of a signed access token in FastAPI with a protected route, the skeleton of the broker's `/exchange` endpoint.

  R22checked 2026-11-11
• videoEric Roby · ~20 min
  FastAPI JWT Tutorial | How to add User Authentication

  Covers the dependency-injection pattern for decoding a bearer token before the handler runs, which is where you insert audience and expiry validation.

  R22checked 2026-11-11
• articleSE with MJ · ~25 min read
  FastAPI + JWT/OAuth2 Authentication from Scratch: A Complete Guide

  Shows a short-lived access token carrying `sub`, `aud`, `iss`, `jti` and `exp` plus validation of every one of them — the exact claim set a delegated, audience-bound token needs.

  R22moved 2026-11-11
• labAuth0 · ~20 min hands-on
  FastAPI API - Auth0 Docs

  Working code that validates an access token and gates endpoints by audience and scope, giving you a reference implementation to compare your local broker's exchanges against.

  R22checked 2026-11-11

A lab is complete only when it produces evidence. Installing PyRIT, Garak, Presidio or TransformerLens is not completion. Saved on this device only.