After completing inbound authentication and authorization with Agent Identity to obtain a Workload Access Token, an agent uses this token to call Agent Identity APIs such as GetResourceOAuth2Token to obtain credentials for accessing specific resources.