{"uri":"https://api.p0.app/agentic/a2a/extensions/subject-delegation/v1","name":"P0 Subject Delegation Extension","version":"v1","type":"data","description":"Provides a mechanism for this agent to make requests on\nbehalf of its callers. Callers pass the 'subject_token' field. The\nagent will perform an RFC 8693 token exchange against the specified\ntoken endpoint prior to making calls on the specified resource.","specification":{"agentCard":[{"field":"params.actor_identity","description":"The sub and iss claims of the actor token that the agent will\npresent in its downstream RFC 8693 token exchange.\n\nPublished in the agent card under this extension's entry in\n'capabilities.extensions', inside its 'params' object.","schema":{"type":"object","properties":{"sub":{"type":"string","description":"Actor token 'sub' claim"},"iss":{"type":"string","description":"Actor token 'iss' claim"}},"required":["sub","iss"],"additionalProperties":false}}],"message":[{"field":"metadata.subject_token","description":"A signed JWT to be used as the subject_token in the agent's\ndownstream RFC 8693 token exchange.\n\nThe subject token includes these relevant fields:\n- aud\n- may_act\n- resource\n\nThe 'aud' field MUST equal the token-exchange endpoint against which the agent\nwill perform token exchange.\n\nThe 'resource' field MUST equal the application-server root to which the agent\nMUST present exchanged tokens for authentication. The agent SHOULD use a single\naccess token for its lifetime, rather than performing a token exchange per\napplication-server request. The agent MUST NOT send access tokens to servers\nother than the application server.\n\nThe token's 'may_act' claim MUST equal the 'actor_identity' value published on\nthe agent's card. The authorization server MUST validate the subject token's\n'may_act' against the 'sub' and 'iss' claims of agent's actor token.","schema":{"type":"string"}}]},"activation":{"header":"X-A2A-Extensions","description":"Clients wishing to use this extension MUST include this\nextension's uri in the comma-separated X-A2A-Extensions request\nheader. Agents that activate the extension MUST echo the uri in\nthe same header on the response."},"references":["https://datatracker.ietf.org/doc/html/rfc8693","https://a2aprotocol.ai/docs/guide/a2a-extensions"]}