OAuth 2.0 Token Exchange의 다양한 얼굴

OAuth 2.0 Token Exchange (RFC 8693) provides a standardized mechanism to convert security tokens across different contexts and recipients—a critical need in microservices and AI-agent architectures where requests traverse multiple services and providers. The fundamental choice between impersonation (transparent but unauditable) and delegation (auditable but constrained) determines security posture, compliance capabilities, and audit trail maintainability. As AI agents proliferate across multiple services, understanding these trade-offs becomes essential for building secure, traceable identity systems in distributed architectures.