{
  "id": 2892625,
  "title": "Trusted AI Agent Transactions, Part 2: PingFederate Token Exchange",
  "url": "https://urgent.news/2026/08/23/trusted-ai-agent-transactions-part-2-pingfederate-token-exchange",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-23T23:01:49.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/darkedges/trusted-ai-agent-transactions-part-2-pingfederate-token-exchange-35pn"
  },
  "original_language": "en",
  "account": "In the second part of the article on Trusted AI Agent Transactions, the focus is on PingFederate's role as a Transaction Token Service (TTS). A TTS uses the RFC 8693 token exchange protocol to generate a Txn-Token. PingFederate assumes this role in the Tokenetes architecture.\n\nThe agent sends two tokens: its subject_token (the user's access token) and actor_token (the agent workload's JWT-SVID). Neither token can replace the other. The TTS profile relies on authenticated TTS clients, but it also includes explicit actor evidence to bind a logical AI agent to its runtime workload.\n\nThe subject token is the user's OAuth access token, while the actor token is a JWT-SVID issued by SPIRE. The agent submits both tokens to PingFederate in a form-encoded RFC 8693 request, using TLS over a protected request body. PingFederate validates the subject token using its subject token processor and the JWT-SVID signature, issuer, audience, time, key ID, and algorithm using its SPIRE processor.\n\nAfter validating both tokens independently, PingFederate issues a short-lived, signed JWT conforming to the Transaction Tokens profile. This Txn-Token includes immutable transaction context such as the target, tool, logical AgentID, and workload details. Unlike OAuth tokens, the Txn-Token is not sent in the OAuth Authorization header between internal workloads.",
  "summary": "Using PingFederate as a Transaction Token Service Part 1 separated the user, logical agent, runtime workload, agent execution, and transaction identities. This part shows where they are joined safely. In the Tokenetes architecture, a Transaction Token Service, or TTS, uses the RFC 8693 token exchange protocol to mint a Txn-Token. This implementation assigns that logical role to PingFederate. The…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 2,
    "also_reported_by": [
      {
        "outlet": "Dev.to",
        "title": "Trusted AI Agent Transactions, Part 3: SPIRE Workload Identity",
        "url": "https://urgent.news/2026/08/23/trusted-ai-agent-transactions-part-3-spire-workload-identity",
        "published": "2026-08-23T23:02:55.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}