AI agents are getting access to the same systems people use: mail, calendars, files, directories. That raises an awkward

question. When an agent calls Microsoft Graph, whose access is it? If the answer is "the user's", the agent can do anything

the user can do. If the answer is "the agent's own service account", the audit log stops saying who asked for what.

This series describes how we handled that in ping-entra-broker , a token broker that sits between PingFederate (PF) and

Microsoft Entra ID. The broker issues an agent a token that names both the user it acts for and the agent doing the work,

and it limits that token to the one resource the agent asked for. This first part covers the front door: the exchange

request, the resource map that decides what is allowed, and the two ways the result can be used.

The problem in one request

A user signs in to PingFederate. PingFederate federates with Entra over OIDC, so the user's identity lives in Entra.…