A backend must call a downstream API within a signed-in user's delegated authorization rather than with unrestricted app-only authority. Which identity flow should be evaluated where supported?

1. Treat the user's name in prompt text as a token
2. OAuth on-behalf-of with appropriate delegated permissions
3. A shared root credential for every user
4. Remove downstream authorization checks