End-User Identity Propagation & On-Behalf-Of (OBO) Tool Execution

[djmcgreal-cc]

Key Use Cases:

1. User-Scoped Operations: A developer asks k8s-agent to restart a deployment or list secrets in a namespace. The tool call should execute under that specific user’s K8s RBAC/OAuth token, failing cleanly if the user lacks access.
2. Auditing & Compliance: SOC2/compliance mandates that actions taken on downstream infrastructure (e.g., Jira, GitHub, Vault, Cloud APIs) are tied to the human principal who initiated the chat session, rather than a generic agent service account.
3. A2A & Multi-Agent Delegation: When an agent delegates sub-tasks to another agent using A2A, the user’s identity scope should propagate down the execution chain without granting blanket privileges.

Proposed Approach

Since kagent uses Google’s ADK under the hood for its execution engine, we could leverage ADK’s identity and token injection capabilities alongside kagent’s CRD architecture.

Context Propagation in Engine/CLI:

Extend kagent invoke and the UI backend to accept user authentication headers (e.g., OIDC Bearer tokens or K8s impersonation headers) and pass them as session context into the ADK runtime.

Declarative Auth in ToolServer CRD:

Introduce an optional auth spec field in the ToolServer custom resource:

apiVersion: kagent.dev/v1alpha1
kind: ToolServer
metadata:
  name: github-mcp-tool
spec:
  mcpServer: ...
  authPolicy:
    type: UserPassthrough # Or OBO / OAuth2TokenExchange
    headerName: Authorization

ADK Tool Harness Injection:

When the ADK engine formats the MCP request to a ToolServer, the runtime checks the calling session's identity context and automatically injects the delegated user token into the tool invocation request headers.
This would make kagent the first K8s-native agent framework to offer zero-trust, enterprise-grade end-user identity delegation out of the box.
Would love to get maintainers' thoughts on whether this fits into the current roadmap or if there's an existing pattern being considered for user-scoped RBAC propagation!