A multi-agent expense system must call a user’s personal calendar and expense APIs using that user’s permissions—not a superuser service account—so agents cannot read other employees’ data. Which authentication approach is most appropriate?

Authentication flows for multi-agent solutions include user impersonation, on-behalf-of, API keys, and OAuth 2.0. The requirement to respect each user’s permissions maps to OAuth 2.0 on-behalf-of/delegated access, so agents act with the signed-in user’s scopes while per-agent application identity is used for non-user resources. Sharing one global admin username and password among all agents in a config map creates shared superuser access. Embedding long-lived personal access tokens for every employee inside each agent image at build time creates secret sprawl. Disabling authentication on internal APIs because the agents run in a private VNet relies on perimeter-only trust. All violate least privilege. Implement token lifetime limits, audience validation, and audit of agent-initiated API calls keyed by user and agent identity.