Glossary
Token Exchange
Token exchange converts one credential into a different one, typically narrower in scope, so that a service making a downstream call can present exactly the access that call needs rather than forwarding its own, broader credential further than necessary. A service holding a token valid for many operations can exchange it for one valid for only the single operation a specific downstream call requires, before making that call.
This limits what a downstream service ever actually sees: instead of every service in a chain holding a copy of the same broad credential, each hop holds only the narrow, exchanged token relevant to its own specific piece of the work, which bounds what a compromise of any single downstream service could actually reach.