What is Identity Propagation?
Identity propagation is the practice of maintaining and forwarding the identity of the original caller through a chain of API calls or agent actions. In multi-hop scenarios – where an agent calls a capability that calls another capability – identity propagation ensures that every action in the chain is attributable to the originating user or system.
Identity propagation in Naftiko
Naftiko is building identity propagation across capability chains:
- Token forwarding – Caller tokens are propagated through orchestration steps. On the roadmap – not yet shipped.
- Identity context – Each capability receives identity context about the original caller, not just the immediate upstream caller. On the roadmap – not yet shipped.
- Trace attribution – OpenTelemetry spans carry the capability and operation invoked across the chain.
- Policy evaluation – Authorization policies can evaluate against the original caller identity, not just the service account of the intermediate capability. On the roadmap – not yet shipped.
Why it matters
Without identity propagation, multi-hop architectures lose accountability. If an agent calls five capabilities in sequence, and the third one causes a compliance violation, the organization needs to know who initiated the chain. Identity propagation provides that traceability.
