Glossary
On-Behalf-Of Context
On-behalf-of context is the original caller's identity, carried forward through a chain of internal service calls, so that a service several hops deep in the chain can still know who actually initiated the request rather than seeing only the service that called it directly. Without this, each hop authorizes based only on its immediate caller's identity, which is usually another internal service — and the request's actual originating human or external caller disappears from the picture entirely by the second or third hop.
This matters directly for authorization decisions made deep in a call chain: a service deciding whether to permit an action needs to know whose action it actually is, and 'the internal service that happens to be calling me right now' is frequently not the right answer to that question. Propagating the real caller's context explicitly through the chain is what makes a correct decision possible at every hop, not just the first one.