Identity and delegation
Before the call, Xokepoint knows who the subject is, who the agent is and whether the subject delegated to the agent.
An agent has no access of its own to anything. It acts for someone: a person in the customer directory or a customer service. If Xokepoint saw only that person, any software with their token would have all of their access. So authorization starts with two identities and a relation between them.
The subject comes from the customer IdP and is verified with the trust recorded for that IdP. The agent is registered in Xokepoint and gets its token in one of two modes: headless, where it proves who it is with its own key, or interactive, where a person signs in from a coding harness and consents. Delegation links the two. The token exchange is the moment where all of this is checked and becomes a short token that the agent uses for its calls. A running instance can also ask, in that exchange, for limits narrower than its policy.