tests/base/src/test/java/org/keycloak/tests/oauth/tokenexchange/ClientDelegationTest.java:446

• The success path authenticates the exchange as test-app and this static mapper makes the actor token valid for that client, so the tests still pass if the new dynamic audience mapper never adds agent-app to the subject token. Cover the advertised mapper-free flow by enabling standard exchange on agent-app, authenticating the exchange as agent-app, removing this mapper, and asserting the subject token audience.

            ProtocolMapperRepresentation audienceMapper = new ProtocolMapperRepresentation();

services/src/main/java/org/keycloak/protocol/oidc/mappers/ParameterizedScopeClientSubMapper.java:22

• This mapper is registered as an Admin UI-selectable protocol mapper, but its configuration exposes no token-claim name or JSON type. A mapper created through the UI therefore reaches mapClaim without claim.name and silently emits nothing; expose the standard attribute configuration as the base parameterized mapper does.

        OIDCAttributeMapperHelper.addIncludeInTokensConfig(configProperties, ParameterizedScopeClientSubMapper.class);

themes/src/main/resources/theme/base/login/messages/messages_en.properties:128

• The base login template calls advancedMsg without the parameter and appends the parameter separately (themes/.../base/login/login-oauth-grant.ftl:24), so this renders literally as Allow {0} to act on your behalf?: agent-app. Pass the parameter to advancedMsg as the keycloak.v2 template does.

clientDelegationScopeConsentText=Allow {0} to act on your behalf?

js/apps/admin-ui/src/clients/add/CapabilityConfig.tsx:505

• Enabling this switch leaves serviceAccountsEnabled false by default, while ClientDelegationScopeType rejects targets without service accounts; the UI can therefore show delegation as enabled although every request silently drops the scope. Mirror the authorization switch behavior by enabling the service account when delegation is turned on.

              <DefaultSwitchControl
                name={convertAttributeNameToForm<FormFields>(
                  "attributes.client.delegation.enabled",
                )}
                label={t("clientDelegationEnabled")}
                labelIcon={t("clientDelegationEnabledHelp")}
                stringify
              />

services/src/main/java/org/keycloak/protocol/oidc/OIDCLoginProtocolFactory.java:415

• This only creates delegation:client while a realm is being created/imported; enabling the feature for an existing realm never runs this path, so the advertised realm-default scope is absent and both existing and subsequently created clients cannot request it without manual setup. Add an existing-realm bootstrap/migration that creates the scope and registers it as an optional default.

            ClientScopeModel clientDelegationScope = newRealm.addClientScope(CLIENT_DELEGATION_SCOPE);