This is the same accounts payable agent you see in the console, shown here through the federation lens. Run the real payment run to watch the actual delegated authority flow (the one the console runs) as a chain of federation interactions: attestation, delegation, per hop token exchange that only narrows, and role enforced resource calls. Or run a cross estate exchange to watch an internal operations agent authenticate on the workforce platform and exchange that token at business banking, which resolves the workforce platform through the federation at the moment of the request. Business banking holds no record of it and shares no secret with it, and the exchanged token is narrower than the one presented, so crossing the boundary attenuates authority rather than widening it. Both authorisation servers are reference implementations standing in for Entra and Ping.