Scoped delegation for AI agents

An agent proves its identity with mTLS, then exchanges a human's token for a short-lived, downscoped, opaque token that is bound to its certificate (RFC 8693, 8705, 7662).

Agent
client cert→ mTLS → Auth server :8443
issues + introspects opaque tokens→ delegated token → Target API :8000
mTLS, cert binding, least privilege

Pick a scenario to run it against the live services.