Unattended batch
Unattended batch / service agent
A cron, a queue worker, a service account with no human on the request. Client credentials and workload identity. Never the password grant. Never a long-lived user refresh token stuffed into the job.
When you see it
Nightly summarization over a corpus the service owns, a pipeline that classifies tickets as itself, a scheduled agent that calls internal APIs with a workload identity. If a human must approve a specific action, that is headless/async (CIBA), not this row.
Actors and trust
Service agentWorkload
Acts as itself. Identified by client_id plus workload identity, not by a user sub.
Authorization server (optional)Other
Issues a client-credentials access token audience-restricted to the API.
ResourceResource
Authorizes a service account / SPIFFE ID. There is no 'on behalf of Alice' unless you moved to an OBO row.
Topology
- SPIRE / issuer→ Workload identity →Batch / cron agent
- Batch / cron agent→ client_credentials (SPIFFE or mTLS client auth) →AS
- Batch / cron agent→ Service-account call; aud = this API →API
Primary
- OAuth 2.1
Client credentials grant.
- SPIFFE / SPIRE
Optional
- JWT authorization grants
RFC 7523 private_key_jwt client auth or JWT grants.
- OAuth SPIFFE client auth
- mTLS sender-constrained tokens
- WIMSE credentials
- AIMS (agent auth BCP)draft / churn
Individual draft — expect churn.
- AAP (OAuth profile)draft / churn
Individual draft — client-credentials plus structured agent claims.
- OAuth Security BCP
RFC 9700.
Do not use
- Resource Owner Password Credentials
Never. Removed from OAuth 2.1.
- Long-lived user refresh token in a cron
That is someone else's grant, parked in a job. Use client credentials, or CIBA when a human must approve.
- OpenID Connect Core
No user on this hop. An ID Token is not an access token.
Why these, and not those
Client credentials (OAuth 2.1) and workload identity (SPIFFE/WIMSE) answer 'which robot is this?' They do not answer 'which human?' — and this row has no human. The password grant is gone (OAuth 2.1 / RFC 9700) and was always the wrong way to let a batch job impersonate someone. A long-lived user refresh token in a cron secret is delegated access with no session, no rotation story, and no way for the user to know the job is still running. If you need a user, use CIBA or an interactive grant at the time of action. AAP and AIMS are draft profiles/BCPs on this shape; treat them as churn.
Related flows
Sequence diagrams, not this topology cut. All flows