Identity & Policy / Token Service (TSS)
FR EN

Identity & Policy

Token Service (TSS)

Issuance and exchange of short-lived tokens for workloads and agents (mTLS, DPoP).

Plane
Identity & Policy
Flow steps
2 · 3
Frameworks
NIST 800-53 · RFC 8693/9449/8705 · 800-207

Technology

Why use it

Issue and exchange short access tokens for services and agents, without distributing long-lived secrets.

Why it matters to security

Removes long-lived secrets, binds the token to its holder (anti-replay) and enables immediate revocation.

Implementations HashiCorp VaultSPIFFE / SPIREAWS STSEntra Workload IdentityKeycloak Token Exchange

A secret that never dies eventually leaks: prefer ephemeral over permanent.

Recommendations by maturity tier

Hover a recommendation for its explanation · each one carries its control number

Foundation

Minimum viable baseline
  • Short-lived tokens; no hard-coded static secrets.
    NIST 800-53 IA-5 · SC-12
    A short token shrinks the exploitable window of a theft; a hard-coded secret is forever.
  • Centralized service-token issuance.
    NIST 800-53 IA-9
    Centralized issuance gives one point to observe and to cut off.
  • End-to-end encrypted transport (TLS).
    NIST 800-53 SC-8
    A token in clear on the wire is an already-compromised token.

Enterprise

Enterprise standard
  • Token exchange (RFC 8693) for controlled delegation.
    RFC 8693NIST 800-53 AC-3
    Explicit delegation prevents services from sharing one secret to act 'on behalf of'.
  • Sender-constrained tokens (DPoP / mTLS), non-replayable.
    RFC 9449 · 8705
    A stolen token is useless outside the client that legitimately obtained it.
  • Audience and scope strictly limited per token.
    NIST 800-53 AC-3 · AC-6
    A token should open one specific door, not the whole building.

Advanced

High-assurance / regulated
  • Ephemeral, just-in-time (JIT) tokens per agent action.
    NIST 800-53 AC-6 · IA-5
    Each step of an agent chain gets a dedicated, minimal token that expires as soon as the action is done.
  • Automatic rotation and revocation wired to the PDP.
    NIST 800-53 IA-5 · AC-12
    A PDP decision can invalidate a live token, not just block the next one.
  • Full traceability: every token attributable to an identity.
    NIST 800-53 AU-2 · AU-12
    Without attribution, you cannot pin an action on an agent during investigation.

Architecture notes

  • Ban long-lived API keys for agents.details ▸
    They end up in logs, repos and shell history.
    Replace them with holder-bound JIT tokens: even if exfiltrated, they are short-lived and non-replayable.

References

RFC 8693
OAuth 2.0 Token Exchange — controlled token delegation and exchange.
RFC 9449 / 8705
DPoP and mTLS-bound tokens — sender-constrained, non-replayable tokens.
NIST SP 800-53 Rev5
IA-5 (Authenticator Management), IA-9 (Service Auth), SC-8/SC-12 (transport & keys), AC-6 (Least Privilege).

Abbreviations

PDP
Policy Decision Point
PEP
Policy Enforcement Point
PIP
Policy Information Point
PAP
Policy Administration Point
IdP
Identity Provider
TSS
Token Service
NHI
Non-Human Identity
RBAC
Role-Based Access Control
ABAC
Attribute-Based Access Control
MFA
Multi-Factor Authentication
HITL
Human-in-the-loop
JIT
Just-In-Time
CAE
Continuous Access Evaluation
CAEP
Continuous Access Evaluation Profile
DPoP
Demonstrating Proof-of-Possession
mTLS
mutual TLS
PII
Personally Identifiable Information
KMS
Key Management Service
CI/CD
Continuous Integration / Continuous Delivery
SIEM
Security Information and Event Management
SOAR
Security Orchestration, Automation and Response
SCIM
System for Cross-domain Identity Management
XACML
eXtensible Access Control Markup Language
OPA
Open Policy Agent
OWASP
Open Worldwide Application Security Project
NIST
National Institute of Standards and Technology
ATLAS
Adversarial Threat Landscape for Artificial-Intelligence Systems
LLM
Large Language Model
WAF
Web Application Firewall
CDN
Content Delivery Network
DDoS
Distributed Denial of Service
DLP
Data Loss Prevention
JWT
JSON Web Token
API
Application Programming Interface
CRS
Core Rule Set (OWASP)
RAG
Retrieval-Augmented Generation
MCP
Model Context Protocol
PBAC
Permission-Based Access Control
HSM
Hardware Security Module
UEBA
User and Entity Behavior Analytics
SBOM
Software Bill of Materials
SLSA
Supply-chain Levels for Software Artifacts
WORM
Write Once, Read Many
SPIFFE
Secure Production Identity Framework For Everyone