Trusted Identity Propagation is a design pattern that carries a user’s authenticated identity across connected services. Instead of every backend seeing only a generic service account, downstream systems receive identity claims, delegated tokens, or other proof of who initiated the request. This lets each service enforce authorization, attribute actions correctly, and produce useful audit logs. It is common in single sign-on, microservices, cloud control planes, and managed workspaces.
In cyber security, the benefit is clear: better traceability and tighter least-privilege access. The risk is also clear: if token scopes are too broad, signatures are not verified, or a platform trusts propagated identity without checking audience and context, an attacker may replay or steal that identity and act as another user inside internal services. Defenses include strong token validation, short-lived credentials, clear trust boundaries, and separate service roles from user context. Proper propagation makes systems easier to defend; weak propagation turns identity into a lateral-movement path.