Files
Enterprise-MCP-Service-Bus/docs/adr/ADR-020-downstream-identity.en-us.md
2026-09-14 14:54:28 -03:00

633 B

ADR-020: Downstream identity: token exchange or isolated service account

Status: Accepted. Source: this ADR is the canonical record of this decision. For implementation and validation context, see RI/docs/AS-BUILT.md and, when applicable, the relevant contract in RI/docs/interfaces/.

Context

Downstream identity in the RI (closes G5/P5).

Decision

Token exchange (RFC 8693) when the backend supports OIDC; otherwise a service account isolated per adapter.

Alternatives Considered

Always reusing the client's token (forbidden by ADR-006).

Consequences

EP-07; documented per backend in the manifest.