What is on-behalf-of?
In short:On-behalf-of describes an agent acting for a specific person and within that person's permissions. The agent never gets more access than the person has. Systems can see both the agent and the person in each request, so accountability does not get lost behind the agent.
How does it work?
The person's token is exchanged for a narrower token naming the agent as actor. Downstream services check both.
What does it look like in practice?
An email agent drafts replies for a manager and can read only that manager's mailbox.