Agent Substrate is solving this - similar to K8s, Substrate is an OIDC (and also SPIFFE) IDP. Credentials containing the actor's identity can be injected into outbound requests using the Substrate egress gateway.

(This is work in flight, but it will land within a few weeks)