When issuing a token for an agent to use, bind it to a signed intent object that travels with the token. The intent object specifies: subject (who is the original requesting user), audience (which system or service this token is for), purpose (what task this token was issued to accomplish), and session (the specific session context this token belongs to).

When an agent attempts to use the token, the policy engine verifies that the current request matches the bound intent. If the agent is attempting a different action, for a different resource, or in a different context than specified in the intent object, the token is rejected — even if it hasn't expired.

Directly stops Scenario 04 (device-code phishing — the agent completes an OAuth flow that binds the victim's tenant to attacker-controlled scopes, but the token's bound intent doesn't match any legitimate task so it can't be reused). Also closes the cross-agent relay path (Scenario 03) — the forwarded instruction produces a token with an intent that doesn't match the finance agent's expected context, so it's rejected.

Standard OAuth tokens carry scope (what the token can do) but not intent (why it was issued or what specific task it's for). An OAuth token with "read:files write:email" scope can be used for any action within those scopes, by any agent that receives it, for any reason. Intent binding adds the missing dimension: this token was issued for this specific task, for this specific user, for this specific purpose.