Asynchronous user workflows

Trimble Identity (TID) supports asynchronous workflows where one application acts on behalf of a user (or other identity) across a chain of applications. TID classifies these workflows by duration and repetitiveness and provides a different mechanism for each class.

Summary of the three classes

Class	Duration	Repetitive	Use when	How-to
#1	< 1 hour	No	The subject is present at the start; the initial access token stays valid for the whole workflow.	On Behalf Grant / Token Exchange
#2	> 1 hour	No	One-time workflows (e.g., onboarding, assignments) where completion can take time; applications maintain a token store and use refresh tokens.	Use refresh tokens for on-behalf-of
#3	> 1 hour	Yes	Repetitive workflows (e.g., scheduled jobs); applications can get on-behalf-of tokens when the primary identity is not present. Requires TID approval.	Use subject delegation for long-running repetitive workflows

For more context and when to choose each class, see the concept Asynchronous workflows with Trimble ID.