An agent reaches an MCP gateway with a user's authorization, then needs to call another service. The gateway cannot reuse its incoming token, and the user may no longer be present to approve another grant. How can the task continue safely?

After a brief ID-JAG primer, this session follows the new Identity Continuation Assertion Internet-Draft through a gateway-to-service flow. The speakers trace how a resource authorization server records an accepted ID-JAG; how a short-lived, sender-constrained assertion reaches the identity provider through OAuth token exchange; and how current policy governs a new, target-specific ID-JAG. They examine trust, actor identity, revocation, and the work required of gateway and downstream authorization server authors.

Unlike the speakers' 2026 AGNTCon/MCPCon talk about the initial ID-JAG flow, this session focuses on the next authorization hop. Attendees will leave with a model for multi-hop agent access and a checklist for MCP-backed services.