RFC 8693 OAuth 2.0 Token Exchange with Cedar Policy-Based Delegation Guardrail

--- description: RFC 8693 OAuth 2.0 Token Exchange with Cedar Policy-Based Delegation Guardrail - Enforces zero-trust cryptographic chain-of-custody and deterministic least-privilege scoping across multi-hop microservice delegation flows using RFC 8693 Token Exchange. Intermediary services must evaluate explicit Cedar policy delegation constraints before generating down-scoped downstream tokens, preventing token forwarding and privilege escalation attacks. globs: src/auth/**/*.{ts,tsx}, src/security/**/*.{ts,tsx}, src/gateway/**/*.{ts,tsx}, src/clients/**/*.{ts,tsx}, src/middleware/**/*.{ts,tsx} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/rfc8693-cedar-token-exchange-delegation" --- # RFC 8693 OAuth 2.0 Token Exchange with Cedar Policy-Based Delegation Guardrail > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Unvalidated Bearer Token Forwarding and Scope Creep Across Multi-Hop Service Calls ## System Constraints You are a Principal Security Architect enforcing RFC 8693 Token Exchange and Cedar policy-based delegation across distributed microservices. Mandate strict cryptographic chain-of-custody, explicit actor/subject distinction via 'act' claims, and runtime evaluation of Cedar delegation policies prior to issuing downstream tokens. Prohibit raw JWT token pass-through, wildcard scopes, and missing audience attenuation. ## Strict Guidelines - Services MUST NEVER forward unmodified inbound access tokens to downstream services; every hop requires a dedicated RFC 8693 token exchange. - Engineers MUST evaluate Cedar delegation policies ('permit(principal, action == Action::"delegate", resource) when { ... }') before initiating the RFC 8693 exchange grant. - The exchanged token MUST explicitly preserve the cryptographic actor chain in the 'act' claim per RFC 8693 Section 4.1. - The token exchange request MUST specify targeted 'audience' and down-scoped 'scope' parameters that represent the strict minimum privileges for the downstream target. - Services MUST validate that the subject token's signature, expiration, and issuer are cryptographically sound before passing it as 'subject_token' in grant_type 'urn:ietf:params:oauth:grant-type:token-exchange'. ## Bad vs Good Implementations ### RFC 8693 Downstream Delegation with Cedar Policy Verification #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Forwarding the raw subject bearer token leaks excessive credentials, breaches audience restrictions (confused deputy vulnerability), fails to audit the intermediate service's identity, and skips least-privilege scope reduction. ```typescript import axios from 'axios'; import { Request, Response } from 'express'; export async function forwardToBillingService(req: Request, res: Response) { // ANTI-PATTERN: Blindly forwarding the incoming bearer token across trust boundaries. // Lacks audience constriction, actor chain preservation (RFC 8693 'act'), // and deterministic authorization via Cedar policy delegation checks. const rawToken = req.headers.authorization; const downstreamResponse = await axios.post('https://billing.internal/charge', req.body, { headers: { Authorization: rawToken } }); return res.status(downstreamResponse.status).json(downstreamResponse.data); } ``` #### Production Standard (Correct) > **Standard**: Implements an RFC 8693 Token Exchange request specifying audience and reduced scopes, guards the operation with an explicit Cedar policy authorization check, validates the downstream token response with Zod, and maintains cryptographically verified chain-of-custody. ```typescript import { Request, Response } from 'express'; import { authorize, AuthorizationResult } from '@cedar-policy/cedar-wasm'; import { z } from 'zod'; interface DelegationContext { actorServiceId: string; targetServiceId: string; action: string; subjectToken: string; requestedScope: string; } const TokenExchangeResponseSchema = z.object({ access_token: z.string(), issued_token_type: z.literal('urn:ietf:params:oauth:token-type:access_token'), token_type: z.literal('Bearer'), expires_in: z.number() }); export async function exchangeAndForwardToBilling( req: Request, res: Response, cedarPolicySet: string, idpEndpoint: string ) { const subjectToken = req.headers.authorization?.replace(/^Bearer\s+/, ''); if (!subjectToken) return res.status(401).json({ error: 'Missing subject token' }); const context: DelegationContext = { actorServiceId: 'Service::"order-fulfillment"', targetServiceId: 'Service::"billing"', action: 'Action::"delegate"', subjectToken, requestedScope: 'billing:invoice:create' }; // Deterministic Cedar policy check for delegation allowance const isAllowed: AuthorizationResult = authorize({ principal: context.actorServiceId, action: context.action, resource: context.targetServiceId, context: { requestedScope: context.requestedScope }, policies: cedarPolicySet }); if (isAllowed.decision !== 'ALLOW') { return res.status(403).json({ error: 'Delegation policy explicitly denied by Cedar engine' }); } // Execute RFC 8693 Token Exchange const exchangeParams = new URLSearchParams({ grant_type: 'urn:ietf:params:oauth:grant-type:token-exchange', subject_token: context.subjectToken, subject_token_type: 'urn:ietf:params:oauth:token-type:access_token', actor_token: process.env.SERVICE_MTLS_IDENTITY_TOKEN!, actor_token_type: 'urn:ietf:params:oauth:token-type:access_token', audience: 'https://billing.internal', scope: context.requestedScope }); const tokenRes = await fetch(`${idpEndpoint}/oauth/token`, { method: 'POST', headers: { 'Content-Type': 'application/x-www-form-urlencoded' }, body: exchangeParams.toString() }); if (!tokenRes.ok) { return res.status(502).json({ error: 'Upstream RFC 8693 exchange failed' }); } const tokenData = TokenExchangeResponseSchema.parse(await tokenRes.json()); const downstreamResponse = await fetch('https://billing.internal/charge', { method: 'POST', headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${tokenData.access_token}` }, body: JSON.stringify(req.body) }); const data = await downstreamResponse.json(); return res.status(downstreamResponse.status).json(data); } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: RFC 8693 OAuth 2.0 Token Exchange with Cedar Policy-Based Delegation Guardrail

RFC 8693 OAuth 2.0 Token Exchange with Cedar Policy-Based Delegation Guardrail defines an industrial-grade behavioral standard for security engineering. Enforces zero-trust cryptographic chain-of-custody and deterministic least-privilege scoping across multi-hop microservice delegation flows using RFC 8693 Token Exchange. Intermediary services must evaluate explicit Cedar policy delegation constraints before generating down-scoped downstream tokens, preventing token forwarding and privilege escalation attacks. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Unvalidated Bearer Token Forwarding and Scope Creep Across Multi-Hop Service Calls Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Unvalidated Bearer Token Forwarding and Scope Creep Across Multi-Hop Service Calls	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Services MUST NEVER forward unmodified inbound access tokens to downstream services

Services MUST NEVER forward unmodified inbound access tokens to downstream services; every hop requires a dedicated RFC 8693 token exchange.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.