A multi-agent expense system must call a user’s personal calendar and expense APIs using that user’s permissions—not a superuser service account—so agents cannot read other employees’ data. Which authentication approach is most appropriate?
Select an answer to reveal the explanation.
Short Explanation
Correct answer: D. When agents must touch user-scoped data, use OAuth 2.0 on-behalf-of (delegated) flows so calls carry the user’s scopes—not a god-mode service account. Keep app identity for non-user resources. Shared admin passwords (A), baking PATs into images (B), and auth-off on private networks (C) violate least privilege and Zero Trust. Pair OBO with short-lived tokens and Conditional Access where applicable.
Full Explanation
Authentication flows for multi-agent solutions include user impersonation, on-behalf-of, API keys, and OAuth 2.0. The requirement to respect each user’s permissions maps to OBO/delegated access. Option D correctly separates delegated user scopes from app-only identity for non-user resources. Options A–C create shared superuser access, secret sprawl, or perimeter-only trust—all incompatible with least privilege. Implement token lifetime limits, audience validation, and audit of agent-initiated API calls keyed by user and agent identity.