Skip to content
Agent Identity

Flow · multi-hop

Workload identity plus user delegation

SPIFFE/WIMSE proves which agent binary is calling. OAuth proves which user it may act for. Both are required in production meshes.

Actors

SPIRE · Agent workload · OAuth AS · Tool

Sequence

  1. 1

    SPIRE→Agent

    Issues X.509-SVID or WIT+WPT material

  2. 2

    Agent→OAuth AS

    Client authentication via SPIFFE (or mTLS RFC 8705) + user grant

  3. 3

    Agent→Tool

    mTLS (workload) + access token (user) or Txn-Token context

Caveats

Do not stuff the user into the SPIFFE ID. Do not skip workload identity because you have an OAuth token — a stolen user token presented by a different binary is a different incident.

Specs in play