delegation
AI security interview questions tagged delegation, across every topic.
7 questions · 1 unlocked for you
Concepts behind "delegation"
Explanations of the mechanisms these questions rely on.
Foundational
OAuth 2.0 and PKCEOAuth 2.0 is a framework for delegated authorization: a user lets an application access a resource on their behalf, with limited scopes, without sharing their password. The authorization code flow sends the user to the authorization server, returns a short-lived code, and exchanges it for tokens. PKCE binds code redemption to a per-flow verifier: someone who steals only the code cannot redeem it. This is not proof of an installed app's identity. Current best practice uses the code flow with PKCE for every client type. Identity & Access
Advanced
Delegated Authorization for AI AgentsAn AI agent acting for a user needs two identities at once: its own, to prove which software is acting, and the user's delegated authority, to decide what it may do. The standard pattern exchanges the user's token at each hop for a new token (OAuth token exchange, RFC 8693) that names the user as subject and the agent as actor, is bound to one audience, narrowed to the task with rich authorization details, bound to the agent's key, and expires in minutes. Resource servers still check ownership against their own data, and high-risk steps get out-of-band user approval bound to the exact action. Identity & Access🔒 Premium
Advanced
Multi-Agent Systems and Agent-to-Agent TrustMulti-agent security depends on the boundaries between cooperating workers. Authenticate peers, establish the user or service-owned task grant, authorize each resource and recipient, and constrain aggregate work. Structured handoffs and provenance support these checks but do not establish truth or permission. A2A provides interoperability; issuers and applications still define the authority and lifecycle of each operation. Agent & MCP Security🔒 Premium