Delegation Exchange

RFC 8693 exchange. Claims are defined only by common/delegation-token.json, signed with ES256 context keys and typ bes-delegation+jwt. A user subject is checked against current PostgreSQL identity and target permissions; scope is limited by feature grants and registered product client scopes. Product service subjects use their real registered role and delegated_client assurance; membership_version and binding_version are zero because they have no person membership or channel binding. A recipient service can forward only to a different registered audience in the single configured downstream allowlist, preserving sub/azp/tenant/channel assurance/versions and optional restrictions, narrowing scope/project and expiry. Omitted project preserves an existing project. Explicit tenant cannot change. Each issuance is audited by jti; no delegation token table is created. A channel-identity subject is channel_type:channel_identifier (for example whatsapp:6591234567), normalized with Control channel rules. AI service authenticates as an active platform service account with the ai-runtime Control role. The binding must be active and verified and the person active. tenant_id, audience (the business product_id) and scope are required; project_id is also required for project-scoped products; context_id is forbidden. Service-client audiences are not accepted for channel subjects. The configured channel_exchange_gate_product_code (default ai-service) must identify an active product with effective authorization for the same tenant/project. phone_binding scope is the intersection of current person permissions and the business product service client registered scopes; deployment_version comes from that same svc-<service_account_id> client. channel_assurance describes how identity was established; each product decides whether to restrict actions based on it. Lifetime is at most 300 seconds and cannot exceed either authorization expiry. AI service exchanges a fresh token before each product tools call (AI service 每次调产品 tools 之前), passes this business-product-audience token through unchanged and discards it after use. act.sub identifies the calling AI service account and act.actor_type is service. Assistant (conversation-gateway) can exchange a widget access_token for its bound host product UUID audience. It requires control.session.validate authority, the registered assistant.widget confidential client, and the same live binding used by session.validate and session.tenant-list. Host closure/generation mismatch returns invalid_grant. Host scope and deployment come from the single active host product service client, intersected with current user permissions; requested scope outside this intersection returns invalid_scope. act.sub is the real Assistant service account UUID and act.actor_type is service. Lifetime is at most 300 seconds and bounded by the subject access token. A fresh widget OIDC authorization declares host_product_id; re-login is required after host generation changes.

POST /oauth/token