Test OAuth agent delegation without trusting the wrong actor

A token can be valid while the policy consuming it is wrong. One particularly useful regression test for agent delegation is an unapproved current actor with an approved actor buried in its history. If the API walks the chain until it finds an allowed name, the test should expose that mistake. This walkthrough uses a fictional invoice-fetching... Weiterlesen: Test OAuth agent delegation without trusting the wrong actor