mirror of
https://github.com/mcloh/Enterprise-MCP-Service-Bus.git
synced 2026-11-06 06:24:12 +00:00
21 lines
633 B
Markdown
21 lines
633 B
Markdown
# ADR-020: Downstream identity: token exchange or isolated service account
|
|
|
|
**Status:** Accepted.
|
|
**Source:** this ADR is the canonical record of this decision. For implementation and validation context, see `RI/docs/AS-BUILT.md` and, when applicable, the relevant contract in `RI/docs/interfaces/`.
|
|
|
|
## Context
|
|
|
|
Downstream identity in the RI (closes G5/P5).
|
|
|
|
## Decision
|
|
|
|
Token exchange (RFC 8693) when the backend supports OIDC; otherwise a service account isolated per adapter.
|
|
|
|
## Alternatives Considered
|
|
|
|
Always reusing the client's token (forbidden by ADR-006).
|
|
|
|
## Consequences
|
|
|
|
EP-07; documented per backend in the manifest.
|