Request-time token exchange is an identity pattern where access credentials are minted only when a specific action is requested. Instead of giving an agent or application a standing secret, an IAM broker verifies the request, evaluates policy, and issues a short-lived token with only the permissions needed for that one operation.
This matters because static credentials are a common failure point in cyber security: if they are stolen, they can be reused for broad or persistent access. Request-time exchange reduces that blast radius, supports least privilege, and improves attribution because each token is tied to a concrete action and context. In real defenses, it is used to let AI agents, services, or connectors reach APIs and SaaS tools without ever storing long-lived keys. In attacks, adversaries often try to capture tokens or abuse overbroad exchanges, so strong scoping, expiry, and logging are essential.