Identity, Auth & Delegated Agent Access (OAuth/A2A/HITL)

When: Basic auth Weeks 1--2; delegated access Weeks 7--8.

• User identity versus service identity versus agent identity.

• OAuth2 flows/scopes; JWT issuer, audience, expiry, signature validation, key rotation, and secure token storage.

• Short-lived, narrowly scoped credentials; never give agents raw passwords or broad long-lived tokens.

• Delegation: which user authorized which action, against which resource, for how long, and how to revoke it.

• Human approval for high-impact actions; bind approval to exact action/arguments, expire it, and prevent reuse.

• Agent-to-agent trust boundaries only if multiple agents actually communicate.

Extra practice: create a small authorization broker for a mock CRM. Issue short-lived scoped tokens and record user, agent, scopes, target resource, expiry, and approval. Verify that token theft/reuse cannot expand privileges.

Do not learn yet: full enterprise identity federation or A2A protocol depth unless the target role/product requires it.