Losing the original caller a few hops in
On-behalf-of context is the original caller's identity, carried forward through a chain of internal service calls, so that a service several hops deep can still know who actually initiated the request rather than seeing only the service that called it directly. Without this, each hop authorizes based only on its immediate caller's identity — usually another internal service — and the request's actual originating human or external caller disappears from the picture entirely by the second or third hop in the chain.
This matters directly for authorization decisions made deep in a call chain: a service deciding whether to permit an action needs to know whose action it actually is, and 'the internal service that happens to be calling me right now' is frequently not the right answer to that question at all.
Propagating context explicitly, rather than losing it by default
Propagating the real caller's context explicitly through the chain — rather than letting it quietly disappear as a byproduct of how internal service calls happen to work — is what makes a correct authorization decision possible at every hop, not just the first one closest to the original request. This connects directly to token exchange as a mechanism: a narrower, exchanged credential at each hop can carry the original caller's identity forward precisely, rather than substituting the calling service's own identity in its place by default.