Mesh sidecar
Workload / mesh sidecar (unattended, no user)
The agent is a binary in a mesh. SPIFFE/SPIRE names it, WIMSE WIT/WPT prove it, mTLS carries it. Client credentials or SPIFFE client auth if an AS is still in the picture. Not an OIDC user sub.
When you see it
An inference service in Kubernetes with a SPIRE agent (or mesh sidecar) issuing X.509-SVIDs. Internal tool-calling microservices with no human on the request. Sidecar proxies that present mTLS to the next hop so the app code never sees a static API key.
Actors and trust
Workload (agent binary)Workload
Identified by a SPIFFE ID / WIMSE identifier. That string is 'payment-api in prod', not 'Alice'.
SPIRE / identity serverOther
Attests the platform and issues short-lived SVIDs or WIT/WIC.
Sidecar / mesh proxyOther
Often the process that actually presents mTLS. The workload identity is still the app's, not the proxy vendor's.
Relying workload / APIResource
Authenticates the peer cert or WPT. Authorization is policy on the SPIFFE ID, optionally plus an OAuth client-credentials token.
Topology
- SPIRE / WIMSE issuer→ X.509-SVID or WIT+WIC →Agent workload
- Agent workload→ Workload API / identity for this pod →Sidecar
- Sidecar→ mTLS / WPT / HTTP signatures →Peer API
- Agent workload→ Optional: SPIFFE client auth + client_credentials →Optional AS
Primary
- SPIFFE / SPIRE
- WIMSE architecture
- WIMSE credentials
WIT / WIC. WIT is not a Bearer token.
- WIMSE WPT
- mTLS sender-constrained tokens
Optional
- OAuth SPIFFE client auth
When the workload must also be an OAuth client.
- OAuth 2.1
Client credentials only — there is no user.
- AIMS (agent auth BCP)draft / churn
Individual draft — expect churn. Agents as workloads.
- WIMSE for AI agentsdraft / churn
Individual draft: why workload ID is not owner ID.
- AAP (OAuth profile)draft / churn
Individual draft — structured claims on a client-credentials token.
Do not use
- OpenID Connect Core
Do not put the user sub in the SPIFFE ID, and do not send an ID Token to the API.
- Static API keys in the sidecar env
The SVID is supposed to replace that.
Why these, and not those
There is no user on this hop, so OIDC user sub is the wrong identifier to stuff into a SPIFFE ID. SPIFFE/SPIRE is how production meshes already name binaries. WIMSE generalizes that across systems (WIT must not be used as Bearer; WPT or HTTP signatures or mTLS are the proof). If the API still wants OAuth, the client authenticates with SPIFFE (or mTLS RFC 8705) and uses the client-credentials grant — the token is the workload's, not Alice's. AIMS is the BCP that says this out loud. AAuth portable agent identity is a different scope (open-world HTTP clients, not your cluster).
Related flows
Sequence diagrams, not this topology cut. All flows