Common mistakes

1 min read · Chapter 9 of 10

What usually goes wrong

Symptom	Likely cause	First thing to check
An agent did something nobody asked for	Injected instructions used a valid token with broad scopes	The token's scopes, and whether that action needed an approval
A customer's data appears in an attacker's leak	Tokens stolen from an integration vendor's store	Which vendors hold refresh tokens for your customers, and how long they live
The log says the user did it; the user says the agent did	No agent identity in the token or audit record	Whether every call records both the person and the agent
A legitimate agent keeps hitting challenges	It sends a plain user agent, or signs only some requests	Which identification method its operator supports
The identity bill jumped with no new customers	Token lifetimes shortened on a per-token meter	Token caching and lifetime per client
An agent still works after its owner left	Refresh tokens or an agent identity with no named owner	Owner or sponsor fields, and what offboarding revokes