A user sends a request to a system A. The request is signed with a digital signature, so the system A can authenticate and authorize the user. Then the system A creates a series of sub-requests to systems B, C, D, ... These sub-requests are based on the original request (in other words they are semantically related to the original request), but the body of these sub-requests is absolutely different from the original request. It's also important to note that the sub-requests are not generated and send after original request immediately. It can be done during days and weeks.
In other words, a user gives a task to the system A to send requests to systems B, C, D, ... during a long enough period of time.
The problem is that the systems B, C, D doesn't trust to the system A. They requires to be sure that the sub-requests are actually based on the original request of the user. The problem is that some evil administrator of system A can send requests to systems B, C, D and have an unauthorized access to a secured information.
It seems that it's absolutely impossible to prevent such a security violation.
The only solution is to let system A to send each sub-request to the user first. The user will sign it. And then system A will send it to other systems. But it's a very complicated solution, because the sub-requests can be generated at any time during a long period. So we will have to distract the user often.
Could you please suggest another approach?
