---
title: "On-behalf-of (OBO) chain · Highflame Glossary"
description: "The unbroken provenance recorded on a credential (who authorized the action, what scope was granted, and how deep the delegation goes) so an audit walks back to a human."
doc_version: "0.1.0"
last_updated: "2026-07-25T03:14:58.002Z"
canonical: "https://www.highflame.com/glossary/obo-chain"
---

[Home](/index.md)·[Glossary](/glossary.md)·On-behalf-of (OBO) chain

# On-behalf-of (OBO) chain

The unbroken provenance recorded on a credential (who authorized the action, what scope was granted, and how deep the delegation goes) so an audit walks back to a human.

Learn more: [Agent Authorization](/learn/ai-agent-authorization.md)

Part of [the Agent Control Fabric](/platform.md): Highflame's identity, policy, and enforcement substrate for AI agents.

[Book a demo](/contact.md) [All terms](/glossary.md)

## Keep exploring the glossary.

[

### Prompt injection

An attack that manipulates an agent through crafted input (in a prompt, a tool result, or retrieved content) to make it act against policy.

Read →](/glossary/prompt-injection.md)[

### Red teaming

Continuous adversarial testing of AI systems (jailbreaks, extraction, manipulation) with findings turned into enforcement policy and re-scanned to prove the fix.

Read →](/glossary/red-teaming.md)[

### RFC 8693 (token exchange)

The standard that lets one token be exchanged for another with attenuated scope: the basis for verifiable agent-to-agent delegation.

Read →](/glossary/rfc-8693.md)[

### Scope attenuation

Narrowing permissions at each delegation hop so a sub-agent can never hold more authority than the agent that delegated to it.

Read →](/glossary/scope-attenuation.md)[

### Shadow agents

Agents running across clouds, IDEs, and SaaS that no one inventoried or assigned an owner: the unmanaged majority of an enterprise's agent footprint.

Read →](/glossary/shadow-agents.md)[

### Shadow AI

The AI tools and autonomous agents adopted across an organization without IT's approval. Shadow IT for the agent era, and faster, because an agent takes minutes to wire up and can act on real systems.

Read →](/glossary/shadow-ai.md)

## Sitemap

Full site map: [/sitemap.md](https://www.highflame.com/sitemap.md). Machine index: [/sitemap-index.xml](https://www.highflame.com/sitemap-index.xml).