DN FIELD GUIDE · INITIAL RELEASE
Token passthrough
Forwarding a received access token to a downstream service without the appropriate audience boundary.
Controls · Reviewed 2026-10-12
See it in a workflow
An intermediary forwards a token intended for itself to another API.
The failure mode
This can bypass controls and obscure accountability; MCP forbids this pattern.
Illustrative scenario, not a measured execution test.
Connect the concepts
Primary documentation
Evidence before authority
DN’s reference hub connects concepts, official sources and practical review questions. It is an editorial reference, not a security certification or legal advice. Entries are dated snapshots, not a continuously monitored feed. Coverage expands only after review.
Commercial relationships do not determine definitions, regulatory conclusions or default tool order. Follow provider eligibility rules and verify permissions before execution.
Suggest a correction · Dictionary JSON · Regulation JSON · Tools JSON