Identity Passthrough
for AI Agents

🎯 What is Identity Passthrough?

Identity passthrough means the AI system doesn't become the identity. Instead, it acts on behalf of the authenticated user, so permissions, row-level security, and audit logs still apply as if the user made the request directly.

Without identity passthrough, AI queries typically run under a shared service account. This means every AI request has the same permissions, and audit logs show "AI Service" instead of the actual user. That's a compliance nightmare.

✨ Three Critical Benefits

🔄 How Token Forwarding Works

The AI application receives the user's authentication token and includes it with every API call to DreamFactory:

💻 Implementation Example

import requests

def ai_query_with_passthrough(user_token, query_params):
    """
    AI generates query but uses the user's token.
    Database permissions apply to the actual user.
    """

    # The key: pass the user's token, not a service account
    response = requests.get(
        f"{DREAMFACTORY_URL}/api/v2/db/_table/orders",
        headers={
            "Authorization": f"Bearer {user_token}",
            "Content-Type": "application/json"
        },
        params=query_params
    )

    # Results are automatically filtered by user's permissions
    # Audit log shows: "User: john.doe@company.com"
    # NOT: "User: ai-service-account"

    return response.json()

🔗 Supported Identity Providers

DreamFactory supports identity passthrough with all major enterprise identity systems:

💡 Why Blast Radius Matters

🚀 Next Steps

• Read the full blog post for detailed implementation guides
• Explore Module 02 to learn about MCP Server configuration
• Review your current AI integrations. Are they using identity passthrough?